ljpegdec: fix point transform injection.

[ffmpeg] / libavcodec / proresdec2.c

diff --git a/libavcodec/proresdec2.c b/libavcodec/proresdec2.c
index aad7b54056e212b41ad883d17e07c34543eea8fa..18decae1166afd6124e39c0ca105022d13b451ac 100644 (file)
--- a/libavcodec/proresdec2.c
+++ b/libavcodec/proresdec2.c
@@ -325,7 +325,7 @@ static av_always_inline void decode_ac_coeffs(AVCodecContext *avctx, GetBitConte
     int log2_block_count = av_log2(blocks_per_slice);
 
     OPEN_READER(re, gb);
-
+    UPDATE_CACHE(re, gb);                                           \
     run   = 4;
     level = 2;
 
@@ -443,7 +443,8 @@ static int decode_slice_thread(AVCodecContext *avctx, void *arg, int jobnr, int
     v_data_size = slice->data_size - y_data_size - u_data_size - hdr_size;
     if (hdr_size > 7) v_data_size = AV_RB16(buf + 6);
 
-    if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0) {
+    if (y_data_size < 0 || u_data_size < 0 || v_data_size < 0
+        || hdr_size+y_data_size+u_data_size+v_data_size > slice->data_size){
         av_log(avctx, AV_LOG_ERROR, "invalid plane data size\n");
         return -1;
     }