From 7b12554c5abca0eb63ddbdfdf6f11c76b9230a0c Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Sun, 24 Feb 2013 14:10:20 +0000 Subject: [PATCH] exr: make sure that data_size is not bigger than expected Signed-off-by: Paul B Mahol --- libavcodec/exr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index 59144a2d8d..cef5e0c612 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -270,7 +270,8 @@ static int decode_block(AVCodecContext *avctx, void *tdata, uncompressed_size = s->scan_line_size * FFMIN(s->scan_lines_per_block, s->ymax - line + 1); if ((s->compr == EXR_RAW && (data_size != uncompressed_size || line_offset > buf_size - uncompressed_size)) || - (s->compr != EXR_RAW && line_offset > buf_size - data_size)) { + (s->compr != EXR_RAW && (data_size > uncompressed_size || + line_offset > buf_size - data_size))) { return AVERROR_INVALIDDATA; }