diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c index 26ba30dd14..45d131aeb8 100644 --- a/libavcodec/aasc.c +++ b/libavcodec/aasc.c @@ -107,11 +107,9 @@ static int aasc_decode_frame(AVCodecContext *avctx, switch (compr) { case 0: stride = (avctx->width * psize + psize) & ~psize; + if (buf_size < stride * avctx->height) + return AVERROR_INVALIDDATA; for (i = avctx->height - 1; i >= 0; i--) { - if (avctx->width * psize > buf_size) { - av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n"); - break; - } memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize); buf += stride; buf_size -= stride;