avcodec/cfhd: check if band encoding is valid

[ffmpeg] / libavcodec / av1_parse.h

diff --git a/libavcodec/av1_parse.h b/libavcodec/av1_parse.h
index 0de619dbeca2ed65052cd462e4b6d881d6d5cfed..01bcd646c2ea85778d0ba16d6e1fe63ee872e4a0 100644 (file)
--- a/libavcodec/av1_parse.h
+++ b/libavcodec/av1_parse.h
@@ -56,12 +56,13 @@ typedef struct AV1Packet {
     AV1OBU *obus;
     int nb_obus;
     int obus_allocated;
+    unsigned obus_allocated_size;
 } AV1Packet;
 
 /**
  * Extract an OBU from a raw bitstream.
  *
- * @note This function does not copy or store any bistream data. All
+ * @note This function does not copy or store any bitstream data. All
  *       the pointers in the AV1OBU structure will be valid as long
  *       as the input buffer also is.
  */
@@ -71,7 +72,7 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length,
 /**
  * Split an input packet into OBUs.
  *
- * @note This function does not copy or store any bistream data. All
+ * @note This function does not copy or store any bitstream data. All
  *       the pointers in the AV1Packet structure will be valid as
  *       long as the input buffer also is.
  */
@@ -134,8 +135,8 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size,
 
     size = *obu_size + *start_pos;
 
-    if (size > INT_MAX)
-        return AVERROR(ERANGE);
+    if (size > buf_size)
+        return AVERROR_INVALIDDATA;
 
     return size;
 }
@@ -145,7 +146,9 @@ static inline int get_obu_bit_length(const uint8_t *buf, int size, int type)
     int v;
 
     /* There are no trailing bits on these */
-    if (type == AV1_OBU_TILE_GROUP || type == AV1_OBU_FRAME) {
+    if (type == AV1_OBU_TILE_GROUP ||
+        type == AV1_OBU_TILE_LIST ||
+        type == AV1_OBU_FRAME) {
         if (size > INT_MAX / 8)
             return AVERROR(ERANGE);
         else