yopdec: check that palette fits in the packet
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 1 Jun 2012 13:51:50 +0000 (15:51 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 6 Jun 2012 22:55:25 +0000 (00:55 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b6fdf8dea7aaf3cb9a979dce91f752c2ce3086a3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/yop.c

index ac17297..df61426 100644 (file)
@@ -204,6 +204,11 @@ static int yop_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
     if (s->frame.data[0])
         avctx->release_buffer(avctx, &s->frame);
 
+    if (avpkt->size < 4 + 3*s->num_pal_colors) {
+        av_log(avctx, AV_LOG_ERROR, "packet of size %d too small\n", avpkt->size);
+        return AVERROR_INVALIDDATA;
+    }
+
     ret = avctx->get_buffer(avctx, &s->frame);
     if (ret < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");