X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhqx.c;h=e2b895ac40bbe7b0793441ccc5caf8b17343fae9;hb=8e12f09a25d7fa2c9e2b63dd6407aece412750a5;hp=bc24ba91d12a6fb66bb43da46589dead6e2639da;hpb=d6b62ce1aced9e2456582870382f384581cc7cbb;p=ffmpeg

diff --git a/libavcodec/hqx.c b/libavcodec/hqx.c
index bc24ba91d12..e2b895ac40b 100644
--- a/libavcodec/hqx.c
+++ b/libavcodec/hqx.c
@@ -471,6 +471,14 @@ static int hqx_decode_frame(AVCodecContext *avctx, void *data,
     avctx->height              = ctx->height;
     avctx->bits_per_raw_sample = 10;
 
+    //The minimum size is 2bit per macroblock
+    // hqx_decode_422 & hqx_decode_444 have a unconditionally stored 4bits hqx_quants index
+    // hqx_decode_422a & hqx_decode_444a use cbp_vlc which has a minimum length of 2 bits for its VLCs
+    // The code rejects slices overlapping in their input data
+    if (avctx->coded_width / 16 * (avctx->coded_height / 16) *
+        (100 - avctx->discard_damaged_percentage) / 100 > 4LL * avpkt->size)
+        return AVERROR_INVALIDDATA;
+
     switch (ctx->format) {
     case HQX_422:
         avctx->pix_fmt = AV_PIX_FMT_YUV422P16;
@@ -512,9 +520,6 @@ static av_cold int hqx_decode_close(AVCodecContext *avctx)
     int i;
     HQXContext *ctx = avctx->priv_data;
 
-    if (avctx->internal->is_copy)
-        return 0;
-
     ff_free_vlc(&ctx->cbp_vlc);
     for (i = 0; i < 3; i++) {
         ff_free_vlc(&ctx->dc_vlc[i]);