/* If necessary, uncompress tiles, and hijack the bytestream reader */
if (packed_tiles_size != tiles_nb * TILE_SIZE) {
uLongf length = tiles_nb * TILE_SIZE;
+
+ if (bytestream2_get_bytes_left(gbc) < packed_tiles_size) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
+
inflated_tiles = av_malloc(length);
if (!inflated_tiles) {
ret = AVERROR(ENOMEM);
ret = AVERROR_INVALIDDATA;
goto end;
}
+ if (ctx->inflated_size < pixel_size) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size);
if (ret) {
av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret);
}
/* Allocate when needed */
- ret = ff_reget_buffer(avctx, ctx->reference);
+ ret = ff_reget_buffer(avctx, ctx->reference, 0);
if (ret < 0)
goto end;
/* Palette handling */
if (avctx->pix_fmt == AV_PIX_FMT_PAL8) {
- int size;
+ buffer_size_t size;
const uint8_t *palette = av_packet_get_side_data(avpkt,
AV_PKT_DATA_PALETTE,
&size);