X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fclearvideo.c;h=65bf1404016e1152c1718125455310eaee5a3e30;hb=9eb7d8b45d0497d75e5655b79d9eea63bedc833c;hp=ad3012f7b789f1256a8b0c8d85a16decd786a0a5;hpb=d0c43e32427ec1efac364be0987a6aafa695527f;p=ffmpeg

diff --git a/libavcodec/clearvideo.c b/libavcodec/clearvideo.c
index ad3012f7b78..65bf1404016 100644
--- a/libavcodec/clearvideo.c
+++ b/libavcodec/clearvideo.c
@@ -524,7 +524,7 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
             return AVERROR_INVALIDDATA;
         }
 
-        if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
+        if ((ret = ff_reget_buffer(avctx, c->pic, 0)) < 0)
             return ret;
 
         c->pic->key_frame = 1;
@@ -555,7 +555,10 @@ static int clv_decode_frame(AVCodecContext *avctx, void *data,
     } else {
         int plane;
 
-        if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
+        if (c->pmb_width * c->pmb_height > 8LL*(buf_size - bytestream2_tell(&gb)))
+            return AVERROR_INVALIDDATA;
+
+        if ((ret = ff_reget_buffer(avctx, c->pic, 0)) < 0)
             return ret;
 
         ret = av_frame_copy(c->pic, c->prev);
@@ -662,7 +665,7 @@ static av_cold int clv_decode_init(AVCodecContext *avctx)
     }
 
     c->tile_shift = av_log2(c->tile_size);
-    if (1 << c->tile_shift != c->tile_size) {
+    if (1U << c->tile_shift != c->tile_size) {
         av_log(avctx, AV_LOG_ERROR, "Tile size: %d, is not power of 2.\n", c->tile_size);
         return AVERROR_INVALIDDATA;
     }