Merge commit '50078c1c8070dd8d1c329e8117ff30ec72489039'

[ffmpeg] / libavformat / oggparsedaala.c

diff --git a/libavformat/oggparsedaala.c b/libavformat/oggparsedaala.c
index dda8d70abdb67d6590aa8b7566f162fb1e5ed176..24567f93a9b4aaa414ee1419077d33b18207e76e 100644 (file)
--- a/libavformat/oggparsedaala.c
+++ b/libavformat/oggparsedaala.c
@@ -130,6 +130,12 @@ static int daala_header(AVFormatContext *s, int idx)
         hdr->fpr = bytestream2_get_byte(&gb);
 
         hdr->format.planes = bytestream2_get_byte(&gb);
+        if (hdr->format.planes > 4) {
+            av_log(s, AV_LOG_ERROR,
+                   "Invalid number of planes %d in daala pixel format map.\n",
+                   hdr->format.planes);
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < hdr->format.planes; i++) {
             hdr->format.xdec[i] = bytestream2_get_byte(&gb);
             hdr->format.ydec[i] = bytestream2_get_byte(&gb);