X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdsicinav.c;h=05d9e4cc1411ef24228cbec09bbd0ebdd15ce3a0;hb=6c1fb3e7631178c2a45c6c41b9b8d9ee3a5298fc;hp=f12560714a2db78bd8abf54d0b6cc6fda6cc00ed;hpb=bb258fb995a42112d1fe14f53ec599b2cd19b707;p=ffmpeg

diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c
index f12560714a2..05d9e4cc141 100644
--- a/libavcodec/dsicinav.c
+++ b/libavcodec/dsicinav.c
@@ -217,7 +217,11 @@ static int cinvideo_decode_frame(AVCodecContext *avctx,
     bitmap_frame_size = buf_size - 4;
 
     /* handle palette */
+    if (bitmap_frame_size < palette_colors_count * (3 + (palette_type != 0)))
+        return AVERROR_INVALIDDATA;
     if (palette_type == 0) {
+        if (palette_colors_count > 256)
+            return AVERROR_INVALIDDATA;
         for (i = 0; i < palette_colors_count; ++i) {
             cin->palette[i] = bytestream_get_le24(&buf);
             bitmap_frame_size -= 3;
@@ -345,26 +349,23 @@ static int cinaudio_decode_frame(AVCodecContext *avctx,
 
 
 AVCodec ff_dsicinvideo_decoder = {
-    "dsicinvideo",
-    AVMEDIA_TYPE_VIDEO,
-    CODEC_ID_DSICINVIDEO,
-    sizeof(CinVideoContext),
-    cinvideo_decode_init,
-    NULL,
-    cinvideo_decode_end,
-    cinvideo_decode_frame,
-    CODEC_CAP_DR1,
+    .name           = "dsicinvideo",
+    .type           = AVMEDIA_TYPE_VIDEO,
+    .id             = CODEC_ID_DSICINVIDEO,
+    .priv_data_size = sizeof(CinVideoContext),
+    .init           = cinvideo_decode_init,
+    .close          = cinvideo_decode_end,
+    .decode         = cinvideo_decode_frame,
+    .capabilities   = CODEC_CAP_DR1,
     .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN video"),
 };
 
 AVCodec ff_dsicinaudio_decoder = {
-    "dsicinaudio",
-    AVMEDIA_TYPE_AUDIO,
-    CODEC_ID_DSICINAUDIO,
-    sizeof(CinAudioContext),
-    cinaudio_decode_init,
-    NULL,
-    NULL,
-    cinaudio_decode_frame,
+    .name           = "dsicinaudio",
+    .type           = AVMEDIA_TYPE_AUDIO,
+    .id             = CODEC_ID_DSICINAUDIO,
+    .priv_data_size = sizeof(CinAudioContext),
+    .init           = cinaudio_decode_init,
+    .decode         = cinaudio_decode_frame,
     .long_name = NULL_IF_CONFIG_SMALL("Delphine Software International CIN audio"),
 };