ret = AVERROR_INVALIDDATA;
goto end;
}
+ if (ctx->inflated_size < pixel_size) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
ret = uncompress(ctx->inflated_buf, &len, gbc->buffer, packed_size);
if (ret) {
av_log(avctx, AV_LOG_ERROR, "Pixel deflate error %d.\n", ret);
}
/* Allocate when needed */
- ret = ff_reget_buffer(avctx, ctx->reference);
+ ret = ff_reget_buffer(avctx, ctx->reference, 0);
if (ret < 0)
goto end;
/* Palette handling */
if (avctx->pix_fmt == AV_PIX_FMT_PAL8) {
- int size;
+ buffer_size_t size;
const uint8_t *palette = av_packet_get_side_data(avpkt,
AV_PKT_DATA_PALETTE,
&size);