X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Flzf.c;h=1e3c86c88c3b28044ff11286bde409569669d8cf;hb=83b6471dcb762859f20b2c414decc755fcceb5e8;hp=5b7526ef1854e6c0477a097d15b557cbbe63dbe9;hpb=5c1aafff2d844b177b0b20db4a38d8460992558b;p=ffmpeg

diff --git a/libavcodec/lzf.c b/libavcodec/lzf.c
index 5b7526ef185..1e3c86c88c3 100644
--- a/libavcodec/lzf.c
+++ b/libavcodec/lzf.c
@@ -49,7 +49,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
         if (s < LZF_LITERAL_MAX) {
             s++;
             if (s > *size - len) {
-                *size += *size /2;
+                *size += s + *size /2;
                 ret = av_reallocp(buf, *size);
                 if (ret < 0)
                     return ret;
@@ -72,7 +72,7 @@ int ff_lzf_uncompress(GetByteContext *gb, uint8_t **buf, int64_t *size)
                 return AVERROR_INVALIDDATA;
 
             if (l > *size - len) {
-                *size += *size / 2;
+                *size += l + *size / 2;
                 ret = av_reallocp(buf, *size);
                 if (ret < 0)
                     return ret;