ffv1dec: more completely check slice count
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 7 Nov 2012 12:26:37 +0000 (13:26 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 7 Nov 2012 12:26:37 +0000 (13:26 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/ffv1dec.c

index 7a4463e..9cd0cff 100644 (file)
@@ -469,9 +469,10 @@ static int read_extra_header(FFV1Context *f)
     f->num_h_slices               = 1 + get_symbol(c, state, 0);
     f->num_v_slices               = 1 + get_symbol(c, state, 0);
 
-    if (f->num_h_slices > (unsigned)f->width ||
-        f->num_v_slices > (unsigned)f->height) {
-        av_log(f->avctx, AV_LOG_ERROR, "too many slices\n");
+    if (f->num_h_slices > (unsigned)f->width  || !f->num_h_slices ||
+        f->num_v_slices > (unsigned)f->height || !f->num_v_slices
+       ) {
+        av_log(f->avctx, AV_LOG_ERROR, "slice count invalid\n");
         return AVERROR_INVALIDDATA;
     }