mpegvideo_parser: fix buffer access beyond end

[ffmpeg] / libavcodec / rawdec.c

diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 4d4bce91f2b46e1cee469e69ea8d7b14b8a23f41..5002ccc1fcebf40cf3385d4bc2b540175f9e2a9b 100644 (file)
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -149,7 +149,7 @@ static void flip(AVCodecContext *avctx, AVPicture * picture){
 }
 
 static int raw_decode(AVCodecContext *avctx,
-                            void *data, int *data_size,
+                            void *data, int *got_frame,
                             AVPacket *avpkt)
 {
     const uint8_t *buf = avpkt->data;
@@ -175,10 +175,8 @@ static int raw_decode(AVCodecContext *avctx,
         frame->top_field_first  = context->tff;
     }
 
-    if (avctx->width <= 0 || avctx->height <= 0) {
-        av_log(avctx, AV_LOG_ERROR, "w/h is invalid\n");
-        return AVERROR(EINVAL);
-    }
+    if ((res = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)
+        return res;
 
     //2bpp and 4bpp raw in avi and mov (yes this is ugly ...)
     if (context->buffer) {
@@ -269,7 +267,7 @@ static int raw_decode(AVCodecContext *avctx,
         }
     }
 
-    *data_size = sizeof(AVPicture);
+    *got_frame = 1;
     return buf_size;
 }