X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fsvq1dec.c;h=e67b460ae31a8cde9e836dc843830fea553dd357;hb=ed0001482a74b60f3d5bc5cd7e304c9d65b2fcd5;hp=d3e60c3a4ab08f97fb2dc3979fcc22289b639b15;hpb=67d466d09b105b2b1d3d8da4c21d8975925741ae;p=ffmpeg

diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c
index d3e60c3a4ab..e67b460ae31 100644
--- a/libavcodec/svq1dec.c
+++ b/libavcodec/svq1dec.c
@@ -32,6 +32,8 @@
  *   http://www.pcisys.net/~melanson/codecs/
  */
 
+#include "libavutil/crc.h"
+
 #include "avcodec.h"
 #include "get_bits.h"
 #include "h263.h"
@@ -546,9 +548,7 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
         if (s->frame_code == 0x50 || s->frame_code == 0x60) {
             int csum = get_bits(bitbuf, 16);
 
-            csum = ff_svq1_packet_checksum(bitbuf->buffer,
-                                           bitbuf->size_in_bits >> 3,
-                                           csum);
+            csum = av_bswap16(av_crc(av_crc_get_table(AV_CRC_16_CCITT), av_bswap16(csum), bitbuf->buffer, bitbuf->size_in_bits >> 3));
 
             ff_dlog(avctx, "%s checksum (%02x) for packet data\n",
                     (csum == 0) ? "correct" : "incorrect", csum);
@@ -602,6 +602,8 @@ static int svq1_decode_frame_header(AVCodecContext *avctx, AVFrame *frame)
         if (skip_1stop_8data_bits(bitbuf) < 0)
             return AVERROR_INVALIDDATA;
     }
+    if (get_bits_left(bitbuf) <= 0)
+        return AVERROR_INVALIDDATA;
 
     s->width  = width;
     s->height = height;
@@ -677,7 +679,7 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
     if (result < 0)
         return result;
 
-    pmv = av_malloc((FFALIGN(s->width, 16) / 8 + 3) * sizeof(*pmv));
+    pmv = av_malloc_array(FFALIGN(s->width, 16) / 8 + 3, sizeof(*pmv));
     if (!pmv)
         return AVERROR(ENOMEM);