diff options
author | Anton Khirnov <anton@khirnov.net> | 2017-02-01 11:50:38 +0100 |
---|---|---|
committer | Anton Khirnov <anton@khirnov.net> | 2017-02-25 09:57:43 +0100 |
commit | b2788fe9347c02b1355574f3d28d60bfe1250ea7 (patch) | |
tree | a5a1302153395cfe45a1fe514d58cea019441d11 /libavcodec/svq3.c | |
parent | cd7a2e1502f174c725c0de82711d2c7649057574 (diff) | |
download | ffmpeg-streaming-b2788fe9347c02b1355574f3d28d60bfe1250ea7.zip ffmpeg-streaming-b2788fe9347c02b1355574f3d28d60bfe1250ea7.tar.gz |
svq3: fix the slice size check
Currently it incorrectly compares bits with bytes.
Also, move the check right before where it's relevant, so that the
correct number of remaining bits is used.
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/svq3.c')
-rw-r--r-- | libavcodec/svq3.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 20c8f89..667d390 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1031,17 +1031,16 @@ static int svq3_decode_slice_header(AVCodecContext *avctx) slice_bits = slice_length * 8; slice_bytes = slice_length + length - 1; - if (slice_bytes > bitstream_bits_left(&s->bc)) { - av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n"); - return -1; - } - bitstream_skip(&s->bc, 8); av_fast_malloc(&s->slice_buf, &s->slice_size, slice_bytes + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->slice_buf) return AVERROR(ENOMEM); + if (slice_bytes * 8 > bitstream_bits_left(&s->bc)) { + av_log(avctx, AV_LOG_ERROR, "slice after bitstream end\n"); + return AVERROR_INVALIDDATA; + } memcpy(s->slice_buf, s->bc.buffer + bitstream_tell(&s->bc) / 8, slice_bytes); if (s->watermark_key) { |