mirror of https://git.ffmpeg.org/ffmpeg.git
dds: validate source buffer size before copying
If it is too small av_image_copy_plane segfaults. Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
parent
b5f963bfec
commit
e6459c655e
|
@ -668,6 +668,12 @@ static int dds_decode(AVCodecContext *avctx, void *data,
|
||||||
frame->palette_has_changed = 1;
|
frame->palette_has_changed = 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",
|
||||||
|
bytestream2_get_bytes_left(gbc), frame->height * linesize);
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
|
|
||||||
av_image_copy_plane(frame->data[0], frame->linesize[0],
|
av_image_copy_plane(frame->data[0], frame->linesize[0],
|
||||||
gbc->buffer, linesize,
|
gbc->buffer, linesize,
|
||||||
linesize, frame->height);
|
linesize, frame->height);
|
||||||
|
|
Loading…
Reference in New Issue