Merge commit '8958c5c64d05453204642b55a7b8b44c93023b17'

[ffmpeg] / libavformat / oggparsedaala.c

diff --git a/libavformat/oggparsedaala.c b/libavformat/oggparsedaala.c
index af6dce0a0d494444ffdf30765dc84c5600b8de8e..3651ca188bd88700b3005f35cee94b4eb6f6550a 100644 (file)
--- a/libavformat/oggparsedaala.c
+++ b/libavformat/oggparsedaala.c
@@ -42,6 +42,7 @@ static const struct DaalaPixFmtMap list_fmts[] = {
 
 typedef struct DaalaInfoHeader {
     int init_d;
+    int fpr;
     int gpshift;
     int gpmask;
     int version_maj;
@@ -122,10 +123,24 @@ static int daala_header(AVFormatContext *s, int idx)
 
         hdr->frame_duration = bytestream2_get_ne32(&gb);
         hdr->gpshift = bytestream2_get_byte(&gb);
-        hdr->gpmask  = (1 << hdr->gpshift) - 1;
+        if (hdr->gpshift >= 32) {
+            av_log(s, AV_LOG_ERROR, "Too large gpshift %d (>= 32).\n",
+                   hdr->gpshift);
+            return AVERROR_INVALIDDATA;
+        }
+        hdr->gpmask  = (1U << hdr->gpshift) - 1;
 
         hdr->format.depth  = 8 + 2*(bytestream2_get_byte(&gb)-1);
+
+        hdr->fpr = bytestream2_get_byte(&gb);
+
         hdr->format.planes = bytestream2_get_byte(&gb);
+        if (hdr->format.planes > 4) {
+            av_log(s, AV_LOG_ERROR,
+                   "Invalid number of planes %d in daala pixel format map.\n",
+                   hdr->format.planes);
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < hdr->format.planes; i++) {
             hdr->format.xdec[i] = bytestream2_get_byte(&gb);
             hdr->format.ydec[i] = bytestream2_get_byte(&gb);