diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c index 9b17941b94..262a5a3ac7 100644 --- a/libavcodec/mpeg12dec.c +++ b/libavcodec/mpeg12dec.c @@ -2299,6 +2299,11 @@ static int decode_chunks(AVCodecContext *avctx, if (s2->picture_structure == PICT_BOTTOM_FIELD) mb_y++; + if (buf_end - buf_ptr < 2) { + av_log(s2->avctx, AV_LOG_ERROR, "slice too small\n"); + return AVERROR_INVALIDDATA; + } + if (mb_y >= s2->mb_height) { av_log(s2->avctx, AV_LOG_ERROR, "slice below image (%d >= %d)\n", mb_y, s2->mb_height); return -1;