X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Findeo2.c;h=ccf6cd84cb62a3aa998db39f6a001dfd2693e293;hb=8c7ea0c3449a3540302c58bffdbcb428ea32eb1d;hp=4971b84308f850a248792cb13507392f51d3cf6e;hpb=c2631dfd0a0a12050cc1765fd41702c5e93abee5;p=ffmpeg

diff --git a/libavcodec/indeo2.c b/libavcodec/indeo2.c
index 4971b84308f..ccf6cd84cb6 100644
--- a/libavcodec/indeo2.c
+++ b/libavcodec/indeo2.c
@@ -56,7 +56,7 @@ static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst
     int j;
     int out = 0;
 
-    if (width & 1)
+    if ((width & 1) || width * height / (2*(IR2_CODES - 0x7F)) > get_bits_left(&ctx->gb))
         return AVERROR_INVALIDDATA;
 
     /* first line contain absolute values, other lines contain deltas */
@@ -79,10 +79,11 @@ static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst
 
     for (j = 1; j < height; j++) {
         out = 0;
-        if (get_bits_left(&ctx->gb) <= 0)
-            return AVERROR_INVALIDDATA;
         while (out < width) {
-            int c = ir2_get_code(&ctx->gb);
+            int c;
+            if (get_bits_left(&ctx->gb) <= 0)
+                return AVERROR_INVALIDDATA;
+            c = ir2_get_code(&ctx->gb);
             if (c >= 0x80) { /* we have a skip */
                 c -= 0x7F;
                 if (out + c*2 > width)
@@ -123,9 +124,9 @@ static int ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_
 
     for (j = 0; j < height; j++) {
         out = 0;
-        if (get_bits_left(&ctx->gb) <= 0)
-            return AVERROR_INVALIDDATA;
         while (out < width) {
+            if (get_bits_left(&ctx->gb) <= 0)
+                return AVERROR_INVALIDDATA;
             c = ir2_get_code(&ctx->gb);
             if (c >= 0x80) { /* we have a skip */
                 c   -= 0x7F;
@@ -160,7 +161,7 @@ static int ir2_decode_frame(AVCodecContext *avctx,
     int start, ret;
     int ltab, ctab;
 
-    if ((ret = ff_reget_buffer(avctx, p)) < 0)
+    if ((ret = ff_reget_buffer(avctx, p, 0)) < 0)
         return ret;
 
     start = 48; /* hardcoded for now */