X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Flcldec.c;h=046cdc4f8eebd067d156fdc8f97e7c2a2e5e7874;hb=648f5c93820ed204bdc477562b61055068c412fe;hp=104defa5f57f648beef789b17a7ef5ebe669b770;hpb=04e4ab44d7c5eca9e1929b34d8fb966afc403e3a;p=ffmpeg

diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index 104defa5f57..046cdc4f8ee 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -190,11 +190,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac
                 ;
             } else if (c->flags & FLAG_MULTITHREAD) {
                 mthread_inlen = AV_RL32(buf);
-                if (len < 8) {
+                if (len < 8 || len - 8 < mthread_inlen) {
                     av_log(avctx, AV_LOG_ERROR, "len %d is too small\n", len);
                     return AVERROR_INVALIDDATA;
                 }
-                mthread_inlen = FFMIN(mthread_inlen, len - 8);
                 mthread_outlen = AV_RL32(buf + 4);
                 mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
                 mszh_dlen = mszh_decomp(buf + 8, mthread_inlen, c->decomp_buf, c->decomp_size);