Commit daea3209 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 873d7e0e
...@@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, ...@@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
if (!(flags & 1)) if (!(flags & 1))
goto unsupported; goto unsupported;
case FF_S3TC_DXT1: case FF_S3TC_DXT1:
if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8) if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 8)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
ff_decode_dxt1(&gb, ptr, w, h, stride); ff_decode_dxt1(&gb, ptr, w, h, stride);
break; break;
case FF_S3TC_DXT3: case FF_S3TC_DXT3:
if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16) if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 16)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
ff_decode_dxt3(&gb, ptr, w, h, stride); ff_decode_dxt3(&gb, ptr, w, h, stride);
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment