diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 642ef02bff..02bb78859a 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -1670,6 +1670,8 @@ static int process_frame_obj(SANMVideoContext *ctx, GetByteContext *gb) /* Rebel Assault 1: 384x242 internal size */ xres = 384; yres = 242; + if (w > xres || h > yres) + return AVERROR_INVALIDDATA; ctx->have_dimensions = 1; } else if (codec == 37 || codec == 47 || codec == 48) { /* these codecs work on full frames, trust their dimensions */