Commit e6459c65 authored by Andreas Cadhalpun's avatar Andreas Cadhalpun Committed by Vittorio Giovara

dds: validate source buffer size before copying

If it is too small av_image_copy_plane segfaults.
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
parent b5f963bf
...@@ -668,6 +668,12 @@ static int dds_decode(AVCodecContext *avctx, void *data, ...@@ -668,6 +668,12 @@ static int dds_decode(AVCodecContext *avctx, void *data,
frame->palette_has_changed = 1; frame->palette_has_changed = 1;
} }
if (bytestream2_get_bytes_left(gbc) < frame->height * linesize) {
av_log(avctx, AV_LOG_ERROR, "Buffer is too small (%d < %d).\n",
bytestream2_get_bytes_left(gbc), frame->height * linesize);
return AVERROR_INVALIDDATA;
}
av_image_copy_plane(frame->data[0], frame->linesize[0], av_image_copy_plane(frame->data[0], frame->linesize[0],
gbc->buffer, linesize, gbc->buffer, linesize,
linesize, frame->height); linesize, frame->height);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment