mirror of https://git.ffmpeg.org/ffmpeg.git
iffdec: Fix integer overflow.
Found-by: durandal_1707 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
22ce78a95e
commit
0e1925ddc4
|
@ -238,6 +238,11 @@ static int extract_header(AVCodecContext *const avctx,
|
||||||
s->mask_buf = av_malloc((s->planesize * 32) + FF_INPUT_BUFFER_PADDING_SIZE);
|
s->mask_buf = av_malloc((s->planesize * 32) + FF_INPUT_BUFFER_PADDING_SIZE);
|
||||||
if (!s->mask_buf)
|
if (!s->mask_buf)
|
||||||
return AVERROR(ENOMEM);
|
return AVERROR(ENOMEM);
|
||||||
|
if (s->bpp > 16) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "bpp %d too large for palette\n", s->bpp);
|
||||||
|
av_freep(&s->mask_buf);
|
||||||
|
return AVERROR(ENOMEM);
|
||||||
|
}
|
||||||
s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + FF_INPUT_BUFFER_PADDING_SIZE);
|
s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + FF_INPUT_BUFFER_PADDING_SIZE);
|
||||||
if (!s->mask_palbuf) {
|
if (!s->mask_palbuf) {
|
||||||
av_freep(&s->mask_buf);
|
av_freep(&s->mask_buf);
|
||||||
|
|
Loading…
Reference in New Issue