Commit 2b73cddd authored by Michael Niedermayer's avatar Michael Niedermayer

proresdec: Check yuv slice data sizes.

Fixes overread
Fixes Ticket812
Bug found by: Oana Stratulat
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 7028c9f4
......@@ -443,7 +443,8 @@ static int decode_slice_thread(AVCodecContext *avctx, void *arg, int jobnr, int
v_data_size = slice->data_size - y_data_size - u_data_size - hdr_size;
if (hdr_size > 7) v_data_size = AV_RB16(buf + 6);
if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0) {
if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0
|| hdr_size+y_data_size+u_data_size+v_data_size > slice->data_size){
av_log(avctx, AV_LOG_ERROR, "invalid plane data size\n");
return -1;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment