Merge commit '7bf9647264308d2df74b2b50669f2d02a7ecc90b'
authorHendrik Leppkes <h.leppkes@gmail.com>
Tue, 18 Aug 2015 07:14:08 +0000 (09:14 +0200)
committerHendrik Leppkes <h.leppkes@gmail.com>
Tue, 18 Aug 2015 07:14:08 +0000 (09:14 +0200)
* commit '7bf9647264308d2df74b2b50669f2d02a7ecc90b':
  vp7: bound checking in vp7_decode_frame_header

Only partially merged, see 46f72ea507afee6adb0d2324848159063d0e7afc

Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
libavcodec/vp8.c

index 4328f40308f488c330b043864edde27471fcc10f..730871a12d8877936a157070c3a9586a30356534 100644 (file)
@@ -493,6 +493,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
     int width  = s->avctx->width;
     int height = s->avctx->height;
 
+    if (buf_size < 4) {
+        return AVERROR_INVALIDDATA;
+    }
+
     s->profile = (buf[0] >> 1) & 7;
     if (s->profile > 1) {
         avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);