get_bits(&s->gb, 8);
}
- if (show_bits_long(&s->gb, 32) == SLICE_START_CODE)
+ if (get_bits_left(&s->gb) >= 32 && show_bits_long(&s->gb, 32) == SLICE_START_CODE)
return get_bits_count(&s->gb);
else
return -1;
if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0)
return ret;
+ if (!(s->avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) {
+ if ((s->width * s->height / 256 / 8) > get_bits_left(&s->gb))
+ return AVERROR_INVALIDDATA;
+ }
+
s->mb_width = (s->width + 15) / 16;
s->mb_height = (s->height + 15) / 16;
s->mb_num = s->mb_width * s->mb_height;
for(i=0; i<13; i++){
for(j=0; j<3; j++){
int v= get_bits(&s->gb, 8);
- v |= get_sbits(&s->gb, 8)<<8;
+ v |= get_sbits(&s->gb, 8) * (1 << 8);
av_log(s->avctx, AV_LOG_DEBUG, " %5d", v);
}
av_log(s->avctx, AV_LOG_DEBUG, "\n");