lavc/bintext: check extradata size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-06-09 15:03:04 +02:00
parent c61c8536ef
commit 1b7a4c93a9

View File

@ -54,6 +54,11 @@ static av_cold int decode_init(AVCodecContext *avctx)
s->font_height = p[0]; s->font_height = p[0];
s->flags = p[1]; s->flags = p[1];
p += 2; p += 2;
if(avctx->extradata_size < 2 + (!!(s->flags & BINTEXT_PALETTE))*3*16
+ (!!(s->flags & BINTEXT_FONT))*s->font_height*256) {
av_log(avctx, AV_LOG_ERROR, "not enough extradata\n");
return AVERROR_INVALIDDATA;
}
} else { } else {
s->font_height = 8; s->font_height = 8;
s->flags = 0; s->flags = 0;