Commit fcdbbbd8 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/iff: decode_delta_j: Check that the number of bytes that will be read are available

This should avoid long loops
related to CID1361958
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 3f5b7a2d
...@@ -865,7 +865,7 @@ static void decode_delta_j(uint8_t *dst, ...@@ -865,7 +865,7 @@ static void decode_delta_j(uint8_t *dst,
for (g = 0; g < groups; g++) { for (g = 0; g < groups; g++) {
offset = bytestream2_get_be16(&gb); offset = bytestream2_get_be16(&gb);
if (bytestream2_get_bytes_left(&gb) < 1) if (cols * bpp == 0 || bytestream2_get_bytes_left(&gb) < cols * bpp)
return; return;
if (kludge_j) if (kludge_j)
...@@ -911,7 +911,7 @@ static void decode_delta_j(uint8_t *dst, ...@@ -911,7 +911,7 @@ static void decode_delta_j(uint8_t *dst,
for (d = 0; d < bpp; d++) { for (d = 0; d < bpp; d++) {
unsigned noffset = offset + (r * pitch) + d * planepitch; unsigned noffset = offset + (r * pitch) + d * planepitch;
if (bytestream2_get_bytes_left(&gb) < 1) if (!bytes || bytestream2_get_bytes_left(&gb) < bytes)
return; return;
for (b = 0; b < bytes; b++) { for (b = 0; b < bytes; b++) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment