From daea3209693f28328ca553fb33fdf8fc2ab42044 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 7 May 2015 19:11:01 +0200 Subject: avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0 Signed-off-by: Michael Niedermayer --- libavcodec/txd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavcodec') diff --git a/libavcodec/txd.c b/libavcodec/txd.c index ad1a015..d2884ad 100644 --- a/libavcodec/txd.c +++ b/libavcodec/txd.c @@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (!(flags & 1)) goto unsupported; case FF_S3TC_DXT1: - if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8) + if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 8) return AVERROR_INVALIDDATA; ff_decode_dxt1(&gb, ptr, w, h, stride); break; case FF_S3TC_DXT3: - if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16) + if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 16) return AVERROR_INVALIDDATA; ff_decode_dxt3(&gb, ptr, w, h, stride); break; -- cgit v1.1