Commit 18a508c5 authored by Mike Melanson's avatar Mike Melanson

handle invalid buffer sizes

Originally committed as revision 2734 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 155aa417
......@@ -900,6 +900,11 @@ static int ipvideo_decode_frame(AVCodecContext *avctx,
IpvideoContext *s = avctx->priv_data;
AVPaletteControl *palette_control = avctx->palctrl;
/* compressed buffer needs to be large enough to at least hold an entire
* decoding map */
if (buf_size < s->decoding_map_size)
return buf_size;
s->decoding_map = buf;
s->buf = buf + s->decoding_map_size;
s->size = buf_size - s->decoding_map_size;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment