num_chunks = bytestream2_get_le16(&g2);
bytestream2_skip(&g2, 8); /* skip padding */
+ if (frame_size < 16)
+ return AVERROR_INVALIDDATA;
+
frame_size -= 16;
/* iterate through the chunks */
while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break;
+ if (y_ptr > pixel_limit)
+ return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2);
if ((line_packets & 0xC000) == 0xC000) {
// line skip opcode
line_packets = -line_packets;
+ if (line_packets > s->avctx->height)
+ return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0];
} else if ((line_packets & 0xC000) == 0x4000) {
av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets);
case FLI_LC:
/* line compressed */
starting_line = bytestream2_get_le16(&g2);
+ if (starting_line >= s->avctx->height)
+ return AVERROR_INVALIDDATA;
y_ptr = 0;
y_ptr += starting_line * s->frame->linesize[0];
break;
}
- if (stream_ptr_after_chunk - bytestream2_tell(&g2) > 0)
+ if (stream_ptr_after_chunk - bytestream2_tell(&g2) >= 0) {
bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
+ } else {
+ av_log(avctx, AV_LOG_ERROR, "Chunk overread\n");
+ break;
+ }
frame_size -= chunk_size;
num_chunks--;
if (frame_size > buf_size)
frame_size = buf_size;
+ if (frame_size < 16)
+ return AVERROR_INVALIDDATA;
frame_size -= 16;
/* iterate through the chunks */
while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break;
+ if (y_ptr > pixel_limit)
+ return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2);
if (line_packets < 0) {
line_packets = -line_packets;
+ if (line_packets > s->avctx->height)
+ return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0];
} else {
compressed_lines--;
break;
}
+ if (stream_ptr_after_chunk - bytestream2_tell(&g2) >= 0) {
+ bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
+ } else {
+ av_log(avctx, AV_LOG_ERROR, "Chunk overread\n");
+ break;
+ }
+
frame_size -= chunk_size;
num_chunks--;
}
if (frame_size > buf_size)
frame_size = buf_size;
+ if (frame_size < 16)
+ return AVERROR_INVALIDDATA;
frame_size -= 16;
/* iterate through the chunks */
while (compressed_lines > 0) {
if (bytestream2_tell(&g2) + 2 > stream_ptr_after_chunk)
break;
+ if (y_ptr > pixel_limit)
+ return AVERROR_INVALIDDATA;
line_packets = bytestream2_get_le16(&g2);
if (line_packets < 0) {
line_packets = -line_packets;
+ if (line_packets > s->avctx->height)
+ return AVERROR_INVALIDDATA;
y_ptr += line_packets * s->frame->linesize[0];
} else {
compressed_lines--;
break;
}
+ if (stream_ptr_after_chunk - bytestream2_tell(&g2) >= 0) {
+ bytestream2_skip(&g2, stream_ptr_after_chunk - bytestream2_tell(&g2));
+ } else {
+ av_log(avctx, AV_LOG_ERROR, "Chunk overread\n");
+ break;
+ }
+
frame_size -= chunk_size;
num_chunks--;
}