wmv1: check that the input buffer is large enough
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 1 Jun 2012 19:42:29 +0000 (21:42 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 6 Jun 2012 22:55:25 +0000 (00:55 +0200)
Fixes null ptr deref
Fixes Ticket1367

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f23a2418fb0ccc56fdae4dbf83a5994cc917c475)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/wnv1.c

index 21ff361..62e9b99 100644 (file)
@@ -70,6 +70,11 @@ static int decode_frame(AVCodecContext *avctx,
     int prev_y = 0, prev_u = 0, prev_v = 0;
     uint8_t *rbuf;
 
+    if(buf_size<=8) {
+        av_log(avctx, AV_LOG_ERROR, "buf_size %d is too small\n", buf_size);
+        return AVERROR_INVALIDDATA;
+    }
+
     rbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
     if(!rbuf){
         av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");