int slice_num = 0;
if (s->slice_params_num_buf != (s->num_x * s->num_y)) {
- s->slice_params_buf = av_realloc_f(s->thread_buf, s->num_x * s->num_y, sizeof(DiracSlice));
+ s->slice_params_buf = av_realloc_f(s->slice_params_buf, s->num_x * s->num_y, sizeof(DiracSlice));
if (!s->slice_params_buf) {
av_log(s->avctx, AV_LOG_ERROR, "slice params buffer allocation failure\n");
+ s->slice_params_num_buf = 0;
return AVERROR(ENOMEM);
}
s->slice_params_num_buf = s->num_x * s->num_y;
else {
s->num_x = get_interleaved_ue_golomb(gb);
s->num_y = get_interleaved_ue_golomb(gb);
+ if (s->num_x * s->num_y == 0 || s->num_x * (uint64_t)s->num_y > INT_MAX) {
+ av_log(s->avctx,AV_LOG_ERROR,"Invalid numx/y\n");
+ s->num_x = s->num_y = 0;
+ return AVERROR_INVALIDDATA;
+ }
if (s->ld_picture) {
s->lowdelay.bytes.num = get_interleaved_ue_golomb(gb);
s->lowdelay.bytes.den = get_interleaved_ue_golomb(gb);
for (j = 0; j < MAX_FRAMES; j++)
if (!s->all_frames[j].avframe->data[0]) {
s->ref_pics[i] = &s->all_frames[j];
- get_buffer_with_edge(s->avctx, s->ref_pics[i]->avframe, AV_GET_BUFFER_FLAG_REF);
+ ret = get_buffer_with_edge(s->avctx, s->ref_pics[i]->avframe, AV_GET_BUFFER_FLAG_REF);
+ if (ret < 0)
+ return ret;
break;
}