h264: tighten the valid range for ref_frame_count

[ffmpeg] / libavcodec / truemotion2.c

diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c
index d280e3220c805cc92077b401d8ed7da7419a6435..172644007c5011522db2fe1891dd92bb7799cc63 100644 (file)
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -291,7 +291,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
     if (len == 0)
         return 4;
 
-    if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) {
+    if (len >= INT_MAX / 4 - 1 || len < 0 || skip > buf_size) {
         av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n");
         return AVERROR_INVALIDDATA;
     }
@@ -856,7 +856,7 @@ static int decode_frame(AVCodecContext *avctx,
     int i, t, ret;
     uint8_t *swbuf;
 
-    swbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
+    swbuf = av_malloc(buf_size + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!swbuf) {
         av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");
         return AVERROR(ENOMEM);