X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Ftruemotion2rt.c;h=9df0b527bbdfb6f66dccb633d87aec9b050792fa;hb=23f447294487958e0c7e8c01b9f9abedb1c7ba78;hp=d63918742dbe1b2abc8b0e8d1335a5e0c4ba5424;hpb=8e9be8ffba03d3327ca1aaf0b1a5f3e2458ea285;p=ffmpeg

diff --git a/libavcodec/truemotion2rt.c b/libavcodec/truemotion2rt.c
index d63918742db..9df0b527bbd 100644
--- a/libavcodec/truemotion2rt.c
+++ b/libavcodec/truemotion2rt.c
@@ -116,6 +116,9 @@ static int truemotion2rt_decode_frame(AVCodecContext *avctx, void *data,
     if (ret < 0)
         return ret;
 
+    if (avctx->width / s->hscale * avctx->height * s->delta_size > avpkt->size * 8LL * 4)
+        return AVERROR_INVALIDDATA;
+
     ret = init_get_bits8(gb, avpkt->data + ret, avpkt->size - ret);
     if (ret < 0)
         return ret;