Merge commit '5c8a5765dc5f4e29afb85b95be393c30f45412a8'

[ffmpeg] / libavcodec / indeo4.c

diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 594c56d163c3ee4a760a93a3d2452bc9cf5da25c..a3562f6fd8f3245c0c5a80cf1572daa0ac54c3f8 100644 (file)
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -187,7 +187,7 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
 
     /* check if picture layout was changed and reallocate buffers */
     if (ivi_pic_config_cmp(&pic_conf, &ctx->pic_conf)) {
-        if (ff_ivi_init_planes(ctx->planes, &pic_conf, 1)) {
+        if (ff_ivi_init_planes(avctx, ctx->planes, &pic_conf, 1)) {
             av_log(avctx, AV_LOG_ERROR, "Couldn't reallocate color planes!\n");
             ctx->pic_conf.luma_bands = 0;
             return AVERROR(ENOMEM);
@@ -237,6 +237,8 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
     /* skip picture header extension if any */
     while (get_bits1(&ctx->gb)) {
         ff_dlog(avctx, "Pic hdr extension encountered!\n");
+        if (get_bits_left(&ctx->gb) < 10)
+            return AVERROR_INVALIDDATA;
         skip_bits(&ctx->gb, 8);
     }