From: Michael Niedermayer <michaelni@gmx.at>
Date: Thu, 7 May 2015 17:11:01 +0000 (+0200)
Subject: avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0
X-Git-Tag: n2.8-dev~659
X-Git-Url: http://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/daea3209693f28328ca553fb33fdf8fc2ab42044

avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---

diff --git a/libavcodec/txd.c b/libavcodec/txd.c
index ad1a015..d2884ad 100644
--- a/libavcodec/txd.c
+++ b/libavcodec/txd.c
@@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             if (!(flags & 1))
                 goto unsupported;
         case FF_S3TC_DXT1:
-            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8)
+            if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 8)
                 return AVERROR_INVALIDDATA;
             ff_decode_dxt1(&gb, ptr, w, h, stride);
             break;
         case FF_S3TC_DXT3:
-            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16)
+            if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 16)
                 return AVERROR_INVALIDDATA;
             ff_decode_dxt3(&gb, ptr, w, h, stride);
             break;