X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdfa.c;h=31c6c3908942528a166ebd54362006ea03666f5c;hb=30f7021aa0be2c978aefb73894b643c9bafbf51c;hp=970175fb734680e6812145c002f95dd54e068623;hpb=7167ac33a8f2c7d063384c267f984f23d2b73854;p=ffmpeg

diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c
index 970175fb734..31c6c390894 100644
--- a/libavcodec/dfa.c
+++ b/libavcodec/dfa.c
@@ -332,7 +332,7 @@ static const chunk_decoder decoder[8] = {
     decode_tdlt, decode_dsw1, decode_blck, decode_dds1,
 };
 
-static const char * const chunk_name[8] = {
+static const char chunk_name[8][5] = {
     "COPY", "TSW1", "BDLT", "WDLT", "TDLT", "DSW1", "BLCK", "DDS1"
 };
 
@@ -355,6 +355,8 @@ static int dfa_decode_frame(AVCodecContext *avctx,
 
     bytestream2_init(&gb, avpkt->data, avpkt->size);
     while (bytestream2_get_bytes_left(&gb) > 0) {
+        if (bytestream2_get_bytes_left(&gb) < 12)
+            return AVERROR_INVALIDDATA;
         bytestream2_skip(&gb, 4);
         chunk_size = bytestream2_get_le32(&gb);
         chunk_type = bytestream2_get_le32(&gb);