wnv1: Make sure the input packet is large enough
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 91be1103fd
)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:

committed by
Luca Barbato

parent
97b6916f93
commit
0c8c6b4419
@@ -71,6 +71,11 @@ static int decode_frame(AVCodecContext *avctx,
|
|||||||
int prev_y = 0, prev_u = 0, prev_v = 0;
|
int prev_y = 0, prev_u = 0, prev_v = 0;
|
||||||
uint8_t *rbuf;
|
uint8_t *rbuf;
|
||||||
|
|
||||||
|
if (buf_size < 8) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Packet is too short\n");
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
|
|
||||||
rbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
|
rbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
|
||||||
if (!rbuf) {
|
if (!rbuf) {
|
||||||
av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");
|
av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");
|
||||||
|
Reference in New Issue
Block a user