/* If necessary, uncompress tiles, and hijack the bytestream reader */
if (packed_tiles_size != tiles_nb * TILE_SIZE) {
uLongf length = tiles_nb * TILE_SIZE;
+
+ if (bytestream2_get_bytes_left(gbc) < packed_tiles_size) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
+
inflated_tiles = av_malloc(length);
if (!inflated_tiles) {
ret = AVERROR(ENOMEM);
}
/* Allocate when needed */
- ret = ff_reget_buffer(avctx, ctx->reference);
+ ret = ff_reget_buffer(avctx, ctx->reference, 0);
if (ret < 0)
goto end;