dsicinav: Clip the source size to the expected maximum

A packet larger than cin->bitmap_size does not make sense.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd81899321)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/dsicinav.c
This commit is contained in:
Luca Barbato 2013-07-19 21:34:21 +02:00
parent 1682c9fb59
commit b8ba48c725

View File

@ -234,6 +234,8 @@ static int cinvideo_decode_frame(AVCodecContext *avctx,
}
}
bitmap_frame_size = FFMIN(cin->bitmap_size, bitmap_frame_size);
/* note: the decoding routines below assumes that surface.width = surface.pitch */
switch (bitmap_frame_type) {
case 9: