From dd11615bbca6ca38e0d9696cc3a4e7ee9c324cdc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 7 Nov 2012 13:26:37 +0100 Subject: [PATCH] ffv1dec: more completely check slice count Signed-off-by: Michael Niedermayer --- libavcodec/ffv1dec.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index 7a4463e4ac..9cd0cff344 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -469,9 +469,10 @@ static int read_extra_header(FFV1Context *f) f->num_h_slices = 1 + get_symbol(c, state, 0); f->num_v_slices = 1 + get_symbol(c, state, 0); - if (f->num_h_slices > (unsigned)f->width || - f->num_v_slices > (unsigned)f->height) { - av_log(f->avctx, AV_LOG_ERROR, "too many slices\n"); + if (f->num_h_slices > (unsigned)f->width || !f->num_h_slices || + f->num_v_slices > (unsigned)f->height || !f->num_v_slices + ) { + av_log(f->avctx, AV_LOG_ERROR, "slice count invalid\n"); return AVERROR_INVALIDDATA; }