avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits

[ffmpeg] / libavcodec / lagarith.c

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 5763504b713fb299c34e09cc73dd30508c3e4ef0..0a45812bc14f38c481f2d316976e8e0cd1579854 100644 (file)
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -226,6 +226,9 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
         }
     }
 
+    if (scale_factor > 23)
+        return AVERROR_INVALIDDATA;
+
     rac->scale = scale_factor;
 
     /* Fill probability array with cumulative probability for each symbol. */
@@ -669,9 +672,6 @@ static int lag_decode_frame(AVCodecContext *avctx,
 
         if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0)
             return ret;
-        if (buf_size <= offset_ry || buf_size <= offset_gu || buf_size <= offset_bv) {
-            return AVERROR_INVALIDDATA;
-        }
 
         if (offset_ry >= buf_size ||
             offset_gu >= buf_size ||