X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhq_hqa.c;h=71753e7cc2ba5871f2d7de66343cbe5b49cef518;hb=d07534b5f5f20b4f780f5b0284aca6354da00695;hp=ec9da3e04fdad66f9e4743783ce2f3e2f248e0c2;hpb=f05f210526a3dc2d9fa6b1c228e3907ebd1d43c6;p=ffmpeg

diff --git a/libavcodec/hq_hqa.c b/libavcodec/hq_hqa.c
index ec9da3e04fd..71753e7cc2b 100644
--- a/libavcodec/hq_hqa.c
+++ b/libavcodec/hq_hqa.c
@@ -248,13 +248,18 @@ static int hqa_decode_frame(HQContext *ctx, AVFrame *pic, size_t data_size)
     int width, height, quant;
     const uint8_t *src = ctx->gbc.buffer;
 
+    if (bytestream2_get_bytes_left(&ctx->gbc) < 8 + 4*(num_slices + 1))
+        return AVERROR_INVALIDDATA;
+
     width  = bytestream2_get_be16(&ctx->gbc);
     height = bytestream2_get_be16(&ctx->gbc);
 
+    ret = ff_set_dimensions(ctx->avctx, width, height);
+    if (ret < 0)
+        return ret;
+
     ctx->avctx->coded_width         = FFALIGN(width,  16);
     ctx->avctx->coded_height        = FFALIGN(height, 16);
-    ctx->avctx->width               = width;
-    ctx->avctx->height              = height;
     ctx->avctx->bits_per_raw_sample = 8;
     ctx->avctx->pix_fmt             = AV_PIX_FMT_YUVA422P;
 
@@ -316,7 +321,7 @@ static int hq_hqa_decode_frame(AVCodecContext *avctx, void *data,
         int info_size;
         bytestream2_skip(&ctx->gbc, 4);
         info_size = bytestream2_get_le32(&ctx->gbc);
-        if (bytestream2_get_bytes_left(&ctx->gbc) < info_size) {
+        if (info_size < 0 || bytestream2_get_bytes_left(&ctx->gbc) < info_size) {
             av_log(avctx, AV_LOG_ERROR, "Invalid INFO size (%d).\n", info_size);
             return AVERROR_INVALIDDATA;
         }
@@ -376,7 +381,7 @@ static av_cold int hq_hqa_decode_close(AVCodecContext *avctx)
     return 0;
 }
 
-AVCodec ff_hq_hqa_decoder = {
+const AVCodec ff_hq_hqa_decoder = {
     .name           = "hq_hqa",
     .long_name      = NULL_IF_CONFIG_SMALL("Canopus HQ/HQA"),
     .type           = AVMEDIA_TYPE_VIDEO,