diff --git a/src/vp8.c b/src/vp8.c index 5b2d46a8..fb3285c2 100644 --- a/src/vp8.c +++ b/src/vp8.c @@ -259,7 +259,12 @@ int VP8GetHeaders(VP8Decoder* const dec, VP8Io* const io) { } br = &dec->br_; - VP8Init(br, buf, buf_size); + if (!VP8Init(br, buf, buf_size)) { + return VP8SetError(dec, 2, "not enough data for bit reader"); + } + if (frm_hdr->partition_length_ > buf_size) { + return VP8SetError(dec, 2, "bad partition length"); + } buf += frm_hdr->partition_length_; buf_size -= frm_hdr->partition_length_; if (frm_hdr->key_frame_) { @@ -391,6 +396,9 @@ static int GetCoeffs(VP8BitReader* const br, ProbaArray prob, return 1; } } + if (n == 16) { + return 1; + } } return 0; }