|
|
@@ -738,7 +738,7 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data, |
|
|
c->tile_height = bytestream2_get_be32(&bc); |
|
|
c->tile_height = bytestream2_get_be32(&bc); |
|
|
if (c->tile_width <= 0 || c->tile_height <= 0 || |
|
|
if (c->tile_width <= 0 || c->tile_height <= 0 || |
|
|
((c->tile_width | c->tile_height) & 0xF) || |
|
|
((c->tile_width | c->tile_height) & 0xF) || |
|
|
c->tile_width * 4LL * c->tile_height >= INT_MAX |
|
|
|
|
|
|
|
|
c->tile_width * (uint64_t)c->tile_height >= INT_MAX / 4 |
|
|
) { |
|
|
) { |
|
|
av_log(avctx, AV_LOG_ERROR, |
|
|
av_log(avctx, AV_LOG_ERROR, |
|
|
"Invalid tile dimensions %dx%d\n", |
|
|
"Invalid tile dimensions %dx%d\n", |
|
|
|