X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Ftruemotion2rt.c;h=9df0b527bbdfb6f66dccb633d87aec9b050792fa;hb=d24c9e55f64eebf67a9e488daa17332533481c20;hp=d63918742dbe1b2abc8b0e8d1335a5e0c4ba5424;hpb=7a10541109cc04ffddc15f0749139aab80f56ebf;p=ffmpeg

diff --git a/libavcodec/truemotion2rt.c b/libavcodec/truemotion2rt.c
index d63918742db..9df0b527bbd 100644
--- a/libavcodec/truemotion2rt.c
+++ b/libavcodec/truemotion2rt.c
@@ -116,6 +116,9 @@ static int truemotion2rt_decode_frame(AVCodecContext *avctx, void *data,
     if (ret < 0)
         return ret;
 
+    if (avctx->width / s->hscale * avctx->height * s->delta_size > avpkt->size * 8LL * 4)
+        return AVERROR_INVALIDDATA;
+
     ret = init_get_bits8(gb, avpkt->data + ret, avpkt->size - ret);
     if (ret < 0)
         return ret;