X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fsmc.c;h=342ebb71d1be32a0672e7e08010291de3f7b543d;hb=7825cc392a2febbe91a1321a522dbdaa49048ae7;hp=79f9a757a0502e63768b287273eb2af7f5605720;hpb=aa6f43c2e959a960792f76d006b8699d733f258f;p=ffmpeg

diff --git a/libavcodec/smc.c b/libavcodec/smc.c
index 79f9a757a05..342ebb71d1b 100644
--- a/libavcodec/smc.c
+++ b/libavcodec/smc.c
@@ -438,10 +438,14 @@ static int smc_decode_frame(AVCodecContext *avctx,
     int pal_size;
     const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, &pal_size);
     int ret;
+    int total_blocks = ((s->avctx->width + 3) / 4) * ((s->avctx->height + 3) / 4);
+
+    if (total_blocks / 1024 > avpkt->size)
+        return AVERROR_INVALIDDATA;
 
     bytestream2_init(&s->gb, buf, buf_size);
 
-    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0)
+    if ((ret = ff_reget_buffer(avctx, s->frame, 0)) < 0)
         return ret;
 
     if (pal && pal_size == AVPALETTE_SIZE) {
@@ -480,4 +484,5 @@ AVCodec ff_smc_decoder = {
     .close          = smc_decode_end,
     .decode         = smc_decode_frame,
     .capabilities   = AV_CODEC_CAP_DR1,
+    .caps_internal  = FF_CODEC_CAP_INIT_THREADSAFE,
 };