mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
vp7: bound checking in vp7_decode_frame_header
CC: libav-stable@libav.org
This commit is contained in:
parent
f34b152eb7
commit
7bf9647264
@ -480,6 +480,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
|
||||
int width = s->avctx->width;
|
||||
int height = s->avctx->height;
|
||||
|
||||
if (buf_size < 4) {
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
s->profile = (buf[0] >> 1) & 7;
|
||||
if (s->profile > 1) {
|
||||
avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);
|
||||
@ -493,6 +497,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
|
||||
buf += 4 - s->profile;
|
||||
buf_size -= 4 - s->profile;
|
||||
|
||||
if (buf_size < part1_size) {
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, sizeof(s->put_pixels_tab));
|
||||
|
||||
ff_vp56_init_range_decoder(c, buf, part1_size);
|
||||
|
Loading…
Reference in New Issue
Block a user