X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Flcldec.c;h=046cdc4f8eebd067d156fdc8f97e7c2a2e5e7874;hb=3ad8af51b7c0a968ac3fd62964780d4ff9136c5a;hp=104defa5f57f648beef789b17a7ef5ebe669b770;hpb=1f1ec958f6c68a5ceafea206a99c895f62d0f3ec;p=ffmpeg

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index 104defa5f57..046cdc4f8ee 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -190,11 +190,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
                 ;
             } else if (c->flags & FLAG_MULTITHREAD) {
                 mthread_inlen = AV_RL32(buf);
-                if (len < 8) {
+                if (len < 8 || len - 8 < mthread_inlen) {
                     av_log(avctx, AV_LOG_ERROR, "len %d is too small\n", len);
                     return AVERROR_INVALIDDATA;
                 }
-                mthread_inlen = FFMIN(mthread_inlen, len - 8);
                 mthread_outlen = AV_RL32(buf + 4);
                 mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
                 mszh_dlen = mszh_decomp(buf + 8, mthread_inlen, c->decomp_buf, c->decomp_size);