CC:[email protected]
---
libavcodec/loco.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/libavcodec/loco.c b/libavcodec/loco.c
index bc33f70..b4a1d15 100644
--- a/libavcodec/loco.c
+++ b/libavcodec/loco.c
@@ -186,43 +186,70 @@ static int decode_frame(AVCodecContext *avctx,
case LOCO_CYUY2: case LOCO_YUY2: case LOCO_UYVY:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 1);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[1], avctx->width / 2,
avctx->height,
p->linesize[1], buf, buf_size, 1);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[2], avctx->width / 2,
avctx->height,
p->linesize[2], buf, buf_size, 1);
break;
case LOCO_CYV12: case LOCO_YV12:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 1);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[2], avctx->width / 2,
avctx->height / 2,
p->linesize[2], buf, buf_size, 1);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[1], avctx->width / 2,
avctx->height / 2,
p->linesize[1], buf, buf_size, 1);
break;
case LOCO_CRGB: case LOCO_RGB:
decoded = loco_decode_plane(l, p->data[0] +
p->linesize[0]*(avctx->height-1), avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[0] +
p->linesize[0]*(avctx->height-1) + 1, avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[0] +
p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
-p->linesize[0], buf, buf_size, 3);
break;
case LOCO_RGBA:
decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
p->linesize[0], buf, buf_size, 4);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[0] + 1, avctx->width,
avctx->height,
p->linesize[0], buf, buf_size, 4);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[0] + 2, avctx->width,
avctx->height,
p->linesize[0], buf, buf_size, 4);
+ if (decoded >= buf_size)
+ goto buf_too_small;
buf += decoded; buf_size -= decoded;
+
decoded = loco_decode_plane(l, p->data[0] + 3, avctx->width,
avctx->height,
p->linesize[0], buf, buf_size, 4);
break;
@@ -231,6 +258,9 @@ static int decode_frame(AVCodecContext *avctx,
*got_frame = 1;
return buf_size;
+buf_too_small:
+ av_log(avctx, AV_LOG_ERROR, "Input data too small.\n");
+ return AVERROR(EINVAL);
}
static av_cold int decode_init(AVCodecContext *avctx)
--
1.7.10.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
