virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

xl: Fix the buffer size check

Browse Source 
Also make it the first check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-07-27 20:34:07 +02:00
parent e13a929314
commit f1cb490d6d
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/xl.c
View File

@ -49,6 +49,11 @@ static int decode_frame(AVCodecContext *avctx,
uint32_t val; uint32_t val;
int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0; int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0;
if (buf_size < avctx->width * avctx->height * sizeof(int32_t)) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
return AVERROR_INVALIDDATA;
}
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) { if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return ret; return ret;
@ -62,11 +67,6 @@ static int decode_frame(AVCodecContext *avctx,
stride = avctx->width - 4; stride = avctx->width - 4;
if (buf_size < avctx->width * avctx->height) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
return AVERROR_INVALIDDATA;
}
for (i = 0; i < avctx->height; i++) { for (i = 0; i < avctx->height; i++) {
/* lines are stored in reversed order */ /* lines are stored in reversed order */
buf += stride; buf += stride;