dsicinav: Clip the source size to the expected maximum
authorLuca Barbato <lu_zero@gentoo.org>
Fri, 19 Jul 2013 19:34:21 +0000 (21:34 +0200)
committerLuca Barbato <lu_zero@gentoo.org>
Mon, 28 Oct 2013 13:16:37 +0000 (14:16 +0100)
A packet larger than cin->bitmap_size does not make sense.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit fd8189932147a524fe43532b46baa35e8be92a1b)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Conflicts:
libavcodec/dsicinav.c

libavcodec/dsicinav.c

index 108424c..03bdeaf 100644 (file)
@@ -234,6 +234,8 @@ static int cinvideo_decode_frame(AVCodecContext *avctx,
         }
     }
 
+    bitmap_frame_size = FFMIN(cin->bitmap_size, bitmap_frame_size);
+
     /* note: the decoding routines below assumes that surface.width = surface.pitch */
     switch (bitmap_frame_type) {
     case 9: