X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fcpia.c;h=bf09e1a5db7e6e81b62aba50c9793a9a56c33970;hb=5501bb28ddfa6441dcbf8ea0a964a13aa33f66fe;hp=58833b2f26706d84ada6a9c1754609ca3629caa4;hpb=b4ca32414ea28ad29b4bd387c298f5a676dace2a;p=ffmpeg

diff --git a/libavcodec/cpia.c b/libavcodec/cpia.c
index 58833b2f267..bf09e1a5db7 100644
--- a/libavcodec/cpia.c
+++ b/libavcodec/cpia.c
@@ -63,7 +63,7 @@ static int cpia_decode_frame(AVCodecContext *avctx,
     uint8_t *y, *u, *v, *y_end, *u_end, *v_end;
 
     // Check header
-    if ( avpkt->size < FRAME_HEADER_SIZE
+    if ( avpkt->size < FRAME_HEADER_SIZE + avctx->height * 3
       || header[0] != MAGIC_0 || header[1] != MAGIC_1
       || (header[17] != SUBSAMPLE_420 && header[17] != SUBSAMPLE_422)
       || (header[18] != YUVORDER_YUYV && header[18] != YUVORDER_UYVY)
@@ -100,7 +100,7 @@ static int cpia_decode_frame(AVCodecContext *avctx,
     }
 
     // Get buffer filled with previous frame
-    if ((ret = ff_reget_buffer(avctx, frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, frame, 0)) < 0)
         return ret;