X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdxtory.c;h=4dd675316b8fbdcc4b06231869f3219360680646;hb=6c777a6688715b21a15cab2cd87c8379225e53ec;hp=7024b315d1c18f338cda1dcfb44164dedb098a48;hpb=d92034a06aadd057b3d3b08a1bd3cb8b1aab0898;p=ffmpeg

diff --git a/libavcodec/dxtory.c b/libavcodec/dxtory.c
index 7024b315d1c..4dd675316b8 100644
--- a/libavcodec/dxtory.c
+++ b/libavcodec/dxtory.c
@@ -286,8 +286,14 @@ static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
 
     off_check = off;
     gb_check = gb;
-    for (slice = 0; slice < nslices; slice++)
-        off_check += bytestream2_get_le32(&gb_check);
+    for (slice = 0; slice < nslices; slice++) {
+        slice_size = bytestream2_get_le32(&gb_check);
+
+        if (slice_size <= 16 + (avctx->height * avctx->width / (8 * nslices)))
+            return AVERROR_INVALIDDATA;
+        off_check += slice_size;
+    }
+
     if (off_check - avctx->discard_damaged_percentage*off_check/100 > src_size)
         return AVERROR_INVALIDDATA;