|
|
|
@@ -142,7 +142,7 @@ static int decode_frame(AVCodecContext *avctx, |
|
|
|
buf += 5; |
|
|
|
|
|
|
|
if (video_size) { |
|
|
|
if (video_size < 0 || video_size > avpkt->size) { |
|
|
|
if (video_size < 0 || video_size > avpkt->size - 5) { |
|
|
|
av_log(avctx, AV_LOG_ERROR, "video size %d invalid\n", video_size); |
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
} |
|
|
|
@@ -153,7 +153,7 @@ static int decode_frame(AVCodecContext *avctx, |
|
|
|
|
|
|
|
if (video_type == 0 || video_type == 1) { |
|
|
|
GetBitContext gb; |
|
|
|
init_get_bits(&gb, buf, 8 * FFMIN(video_size, buf_end - buf)); |
|
|
|
init_get_bits(&gb, buf, 8 * video_size); |
|
|
|
|
|
|
|
for (j = 0; j < avctx->height; j += 8) |
|
|
|
for (i = 0; i < avctx->width; i += 8) |
|
|
|
|