mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/ffv1dec: Fix AC_GOLOMB_RICE min size check
Found-by: mkver Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
15785e044e
commit
f7d510b33f
|
@ -884,9 +884,13 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
} else {
|
} else {
|
||||||
int w = avctx->width;
|
int w = avctx->width;
|
||||||
for (int i = 0; w > (1<<ff_log2_run[i]); i++)
|
int s = 1 + w / (1<<23);
|
||||||
|
|
||||||
|
w /= s;
|
||||||
|
|
||||||
|
for (i = 0; w > (1<<ff_log2_run[i]); i++)
|
||||||
w -= ff_log2_run[i];
|
w -= ff_log2_run[i];
|
||||||
if (buf_size < (avctx->height + i + 6)/ 8)
|
if (buf_size < (avctx->height + i + 6) / 8 * s)
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue