X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Ffmvc.c;h=3701b0849b79c48a26fbd34a83fe80ecb0092f66;hb=e5bcda6473a2d6984216004506374669501fcf3b;hp=5778d7b53f8472fcae76601513b338812ebf72f1;hpb=27e30c73d722ec13e59753dea91be00859c72bf2;p=ffmpeg

diff --git a/libavcodec/fmvc.c b/libavcodec/fmvc.c
index 5778d7b53f8..3701b0849b7 100644
--- a/libavcodec/fmvc.c
+++ b/libavcodec/fmvc.c
@@ -402,6 +402,9 @@ static int decode_frame(AVCodecContext *avctx, void *data,
     AVFrame *frame = data;
     int ret, y, x;
 
+    if (avpkt->size < 8)
+        return AVERROR_INVALIDDATA;
+
     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
         return ret;
 
@@ -437,6 +440,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
             memcpy(dst, src, avctx->width * s->bpp);
             dst -= frame->linesize[0];
             src += s->stride * 4;
+            if (bytestream2_tell_p(pb) < y*s->stride * 4)
+                break;
         }
     } else {
         unsigned block, nb_blocks;