if (avctx->extradata_size < 14)
return AVERROR_INVALIDDATA;
+ if (avctx->channels <= 0) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid number of channels: %d\n", avctx->channels);
+ return AVERROR_INVALIDDATA;
+ }
+
s->level = AV_RL16(avctx->extradata + 12) & 0xf;
s->rows = AV_RL16(avctx->extradata + 12) >> 4;
s->cols = 1 << s->level;
s->block = av_calloc(s->block_len, sizeof(int));
s->wrapbuf = av_calloc(s->wrapbuf_len, sizeof(int));
s->ampbuf = av_calloc(0x10000, sizeof(int));
- s->bitstream = av_calloc(s->max_framesize, sizeof(*s->bitstream));
+ s->bitstream = av_calloc(s->max_framesize + AV_INPUT_BUFFER_PADDING_SIZE / sizeof(*s->bitstream) + 1, sizeof(*s->bitstream));
if (!s->block || !s->wrapbuf || !s->ampbuf || !s->bitstream)
return AVERROR(ENOMEM);
for (i = 0; i < s->rows; i++) {
/* b = (x1) + (x2 * 3) + (x3 * 9) */
b = get_bits(gb, 5);
+ if (b > 26) {
+ av_log(NULL, AV_LOG_ERROR, "Too large b = %d > 26\n", b);
+ return AVERROR_INVALIDDATA;
+ }
n1 = (mul_3x3[b] & 0x0F) - 1;
n2 = ((mul_3x3[b] >> 4) & 0x0F) - 1;
for (i = 0; i < s->rows; i++) {
/* b = (x1) + (x2 * 5) + (x3 * 25) */
b = get_bits(gb, 7);
+ if (b > 124) {
+ av_log(NULL, AV_LOG_ERROR, "Too large b = %d > 124\n", b);
+ return AVERROR_INVALIDDATA;
+ }
n1 = (mul_3x5[b] & 0x0F) - 2;
n2 = ((mul_3x5[b] >> 4) & 0x0F) - 2;
for (i = 0; i < s->rows; i++) {
/* b = (x1) + (x2 * 11) */
b = get_bits(gb, 7);
+ if (b > 120) {
+ av_log(NULL, AV_LOG_ERROR, "Too large b = %d > 120\n", b);
+ return AVERROR_INVALIDDATA;
+ }
n1 = (mul_2x11[b] & 0x0F) - 5;
n2 = ((mul_2x11[b] >> 4) & 0x0F) - 5;