X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;ds=sidebyside;f=libavcodec%2Fclearvideo.c;h=82df8f37522e646a20c2f920356cb716708ed1a6;hb=2db7a3bc4acdd293ed10b71e55f16a45ca28b629;hp=ad3012f7b789f1256a8b0c8d85a16decd786a0a5;hpb=4dc1f06f0c84ebbd8b26cd77679450903244a3e8;p=ffmpeg

diff --git a/libavcodec/clearvideo.c b/libavcodec/clearvideo.c
index ad3012f7b78..82df8f37522 100644
--- a/libavcodec/clearvideo.c
+++ b/libavcodec/clearvideo.c
@@ -555,6 +555,9 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
     } else {
         int plane;
 
+        if (c->pmb_width * c->pmb_height > 8LL*(buf_size - bytestream2_tell(&gb)))
+            return AVERROR_INVALIDDATA;
+
         if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
             return ret;