s->level++;
av_log(avctx, AV_LOG_DEBUG, "Subband number %"PRIu16"\n", data);
s->subband_num = data;
- if (s->level > DWT_LEVELS) {
+ if (s->level >= DWT_LEVELS) {
av_log(avctx, AV_LOG_ERROR, "Invalid level\n");
ret = AVERROR(EINVAL);
break;
s->plane[s->channel_num].band[0][0].width = data;
s->plane[s->channel_num].band[0][0].stride = data;
av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data);
- if (data < 2 || (data & 1) || data > s->plane[s->channel_num].band[0][0].a_width) {
+ if (data < 2 || data > s->plane[s->channel_num].band[0][0].a_width) {
av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n");
ret = AVERROR(EINVAL);
break;
break;
} else if (tag == 2) {
av_log(avctx, AV_LOG_DEBUG, "tag=2 header - skipping %i tag/value pairs\n", data);
+ if (data > bytestream2_get_bytes_left(&gb) / 4) {
+ av_log(avctx, AV_LOG_ERROR, "too many tag/value pairs (%d)\n", data);
+ ret = AVERROR_INVALIDDATA;
+ break;
+ }
for (i = 0; i < data; i++) {
uint16_t tag2 = bytestream2_get_be16(&gb);
uint16_t val2 = bytestream2_get_be16(&gb);
s->plane[s->channel_num].band[s->level][s->subband_num].width = data;
s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i subband %i\n", data, s->channel_num, s->level, s->subband_num);
- if (data < 2 || (data & 1)) {
+ if (data < 2) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n");
ret = AVERROR(EINVAL);
break;
s->plane[s->channel_num].band[s->level][s->subband_num].width = data;
s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data);
- if (data < 2 || (data & 1)) {
+ if (data < 2) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n");
ret = AVERROR(EINVAL);
break;