return mb_count;
}
-static int rv20_decode_picture_header(RVDecContext *rv)
+static int rv20_decode_picture_header(RVDecContext *rv, int whole_size)
{
MpegEncContext *s = &rv->m;
int seq, mb_pos, i, ret;
"attempting to change resolution to %dx%d\n", new_w, new_h);
if (av_image_check_size(new_w, new_h, 0, s->avctx) < 0)
return AVERROR_INVALIDDATA;
+
+ if (whole_size < (new_w + 15)/16 * ((new_h + 15)/16) / 8)
+ return AVERROR_INVALIDDATA;
+
ff_mpv_common_end(s);
// attempt to keep aspect during typical resolution switches
if (s->codec_id == AV_CODEC_ID_RV10)
mb_count = rv10_decode_picture_header(s);
else
- mb_count = rv20_decode_picture_header(rv);
+ mb_count = rv20_decode_picture_header(rv, whole_size);
if (mb_count < 0) {
if (mb_count != ERROR_SKIP_FRAME)
av_log(s->avctx, AV_LOG_ERROR, "HEADER ERROR\n");
return avpkt->size;
}
-AVCodec ff_rv10_decoder = {
+const AVCodec ff_rv10_decoder = {
.name = "rv10",
.long_name = NULL_IF_CONFIG_SMALL("RealVideo 1.0"),
.type = AVMEDIA_TYPE_VIDEO,
},
};
-AVCodec ff_rv20_decoder = {
+const AVCodec ff_rv20_decoder = {
.name = "rv20",
.long_name = NULL_IF_CONFIG_SMALL("RealVideo 2.0"),
.type = AVMEDIA_TYPE_VIDEO,