Commit 8c59e0c3 authored by Michael Niedermayer's avatar Michael Niedermayer

xldec: move buffer size check up, it can be done before allocating a frame

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 94b42da6
...@@ -57,6 +57,11 @@ static int decode_frame(AVCodecContext *avctx, ...@@ -57,6 +57,11 @@ static int decode_frame(AVCodecContext *avctx,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (buf_size < avctx->width * avctx->height) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
return AVERROR_INVALIDDATA;
}
if(p->data[0]) if(p->data[0])
avctx->release_buffer(avctx, p); avctx->release_buffer(avctx, p);
...@@ -74,11 +79,6 @@ static int decode_frame(AVCodecContext *avctx, ...@@ -74,11 +79,6 @@ static int decode_frame(AVCodecContext *avctx,
stride = avctx->width - 4; stride = avctx->width - 4;
if (buf_size < avctx->width * avctx->height) {
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
return AVERROR_INVALIDDATA;
}
for (i = 0; i < avctx->height; i++) { for (i = 0; i < avctx->height; i++) {
/* lines are stored in reversed order */ /* lines are stored in reversed order */
buf += stride; buf += stride;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment