X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fvp3.c;h=57c6eb1ff9812ab7073a00dd0b8588b6ee3470c8;hb=df1c30f139bd4c4d5426d4fc169a1a2c16f95163;hp=cf64a8c61e4767c60f279e5f8c79445fd17e6d6f;hpb=420476ec7819ae15efb6d294767c454601715d74;p=ffmpeg

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index cf64a8c61e4..57c6eb1ff98 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -35,6 +35,7 @@
 #include <string.h>
 
 #include "libavutil/imgutils.h"
+#include "libavutil/mem_internal.h"
 
 #include "avcodec.h"
 #include "get_bits.h"
@@ -2874,6 +2875,9 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
     int ret;
     AVRational fps, aspect;
 
+    if (get_bits_left(gb) < 206)
+        return AVERROR_INVALIDDATA;
+
     s->theora_header = 0;
     s->theora = get_bits(gb, 24);
     av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora);