ltab = buf[0x22] & 3;
ctab = buf[0x22] >> 2;
+
+ if (ctab > 3) {
+ av_log(avctx, AV_LOG_ERROR, "ctab %d is invalid\n", ctab);
+ return AVERROR_INVALIDDATA;
+ }
+
if (s->decode_delta) { /* intraframe */
if ((ret = ir2_decode_plane(s, avctx->width, avctx->height,
p->data[0], p->linesize[0],