mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-09-06 08:08:58 +02:00
xl: Fix the buffer size check
Also make it the first check. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
This commit is contained in:
parent
e13a929314
commit
f1cb490d6d
@ -49,6 +49,11 @@ static int decode_frame(AVCodecContext *avctx,
|
||||
uint32_t val;
|
||||
int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0;
|
||||
|
||||
if (buf_size < avctx->width * avctx->height * sizeof(int32_t)) {
|
||||
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
|
||||
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
|
||||
return ret;
|
||||
@ -62,11 +67,6 @@ static int decode_frame(AVCodecContext *avctx,
|
||||
|
||||
stride = avctx->width - 4;
|
||||
|
||||
if (buf_size < avctx->width * avctx->height) {
|
||||
av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
for (i = 0; i < avctx->height; i++) {
|
||||
/* lines are stored in reversed order */
|
||||
buf += stride;
|
||||
|
Loading…
Reference in New Issue
Block a user