diff options
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/iff.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 0685cd415a..47f491b4e8 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -114,6 +114,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx, IffContext *s = avctx->priv_data; const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; + const uint8_t *buf_end = buf+buf_size; int y, plane; if (avctx->reget_buffer(avctx, &s->frame) < 0){ @@ -121,19 +122,14 @@ static int decode_frame_ilbm(AVCodecContext *avctx, return -1; } - if (buf_size < avctx->width * avctx->height) { - av_log(avctx, AV_LOG_ERROR, "buffer underflow\n"); - return -1; - } - for(y = 0; y < avctx->height; y++ ) { uint8_t *row = &s->frame.data[0][ y*s->frame.linesize[0] ]; memset(row, 0, avctx->pix_fmt == PIX_FMT_PAL8 ? avctx->width : (avctx->width * 4)); - for (plane = 0; plane < avctx->bits_per_coded_sample; plane++) { + for (plane = 0; plane < avctx->bits_per_coded_sample && buf < buf_end; plane++) { if (avctx->pix_fmt == PIX_FMT_PAL8) { - decodeplane8(row, buf, s->planesize, avctx->bits_per_coded_sample, plane); + decodeplane8(row, buf, FFMIN(s->planesize, buf_end - buf), avctx->bits_per_coded_sample, plane); } else { // PIX_FMT_BGR32 - decodeplane32(row, buf, s->planesize, avctx->bits_per_coded_sample, plane); + decodeplane32(row, buf, FFMIN(s->planesize, buf_end - buf), avctx->bits_per_coded_sample, plane); } buf += s->planesize; } |