#include <string.h>
#include "libavutil/intreadwrite.h"
+#include "libavutil/mem.h"
#include "avcodec.h"
#include "bytestream.h"
#define BITSTREAM_READER_LE
#include "get_bits.h"
-// for av_memcpy_backptr
-#include "libavutil/lzo.h"
#define RUNTIME_GAMMA 0
case 9:
case 19:
+ if (buf_end - size_segment < 1) {
+ av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
+ return AVERROR_INVALIDDATA;
+ }
size = *size_segment++;
break;
case 10:
case 20:
+ if (buf_end - size_segment < 2) {
+ av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
+ return AVERROR_INVALIDDATA;
+ }
size = AV_RB16(&size_segment[0]);
size_segment += 2;
break;
case 11:
case 21:
+ if (buf_end - size_segment < 3) {
+ av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
+ return AVERROR_INVALIDDATA;
+ }
size = AV_RB24(size_segment);
size_segment += 3;
break;