X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhqx.c;h=39404d24e5d6371e94ff0ad0d88e0d3573eaa1c5;hb=d4440c7e91b0ef5f6776d98c51dbb6cd66ea0194;hp=bc24ba91d12a6fb66bb43da46589dead6e2639da;hpb=50ae1f7e0ff1fa00236622415039f7e28d919a25;p=ffmpeg

diff --git a/libavcodec/hqx.c b/libavcodec/hqx.c
index bc24ba91d12..39404d24e5d 100644
--- a/libavcodec/hqx.c
+++ b/libavcodec/hqx.c
@@ -471,6 +471,14 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data,
     avctx->height              = ctx->height;
     avctx->bits_per_raw_sample = 10;
 
+    //The minimum size is 2bit per macroblock
+    // hqx_decode_422 & hqx_decode_444 have a unconditionally stored 4bits hqx_quants index
+    // hqx_decode_422a & hqx_decode_444a use cbp_vlc which has a minimum length of 2 bits for its VLCs
+    // The code rejects slices overlapping in their input data
+    if (avctx->coded_width / 16 * (avctx->coded_height / 16) *
+        (100 - avctx->discard_damaged_percentage) / 100 > 4LL * avpkt->size)
+        return AVERROR_INVALIDDATA;
+
     switch (ctx->format) {
     case HQX_422:
         avctx->pix_fmt = AV_PIX_FMT_YUV422P16;