ffv1dec: more completely check slice count

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-07 13:26:37 +01:00
parent cb395929e3
commit dd11615bbc
1 changed files with 4 additions and 3 deletions

View File

@ -469,9 +469,10 @@ static int read_extra_header(FFV1Context *f)
f->num_h_slices = 1 + get_symbol(c, state, 0);
f->num_v_slices = 1 + get_symbol(c, state, 0);
if (f->num_h_slices > (unsigned)f->width ||
f->num_v_slices > (unsigned)f->height) {
av_log(f->avctx, AV_LOG_ERROR, "too many slices\n");
if (f->num_h_slices > (unsigned)f->width || !f->num_h_slices ||
f->num_v_slices > (unsigned)f->height || !f->num_v_slices
) {
av_log(f->avctx, AV_LOG_ERROR, "slice count invalid\n");
return AVERROR_INVALIDDATA;
}