X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fxan.c;h=1ccf164847bb70aa963534b399cebd84ac4bf720;hb=09100ccc14690a9d781f055642b5b880752ee636;hp=4c01c0013fd8d8b13843752c801eb06a7885f54f;hpb=ff173ce8f1a8d043ce87c02a017ec55bb51b2297;p=ffmpeg

diff --git a/libavcodec/xan.c b/libavcodec/xan.c
index 4c01c0013fd..1ccf164847b 100644
--- a/libavcodec/xan.c
+++ b/libavcodec/xan.c
@@ -131,7 +131,10 @@ static int xan_huffman_decode(uint8_t *dest, int dest_len,
         return ret;
 
     while (val != 0x16) {
-        unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
+        unsigned idx;
+        if (get_bits_left(&gb) < 1)
+            return AVERROR_INVALIDDATA;
+        idx = val - 0x17 + get_bits1(&gb) * byte;
         if (idx >= 2 * byte)
             return AVERROR_INVALIDDATA;
         val = src[idx];
@@ -263,7 +266,7 @@ static inline void xan_wc3_copy_pixel_run(XanContext *s, AVFrame *frame,
     prevframe_index = (y + motion_y) * stride + x + motion_x;
     prevframe_x = x + motion_x;
 
-    if (prev_palette_plane == palette_plane && FFABS(curframe_index - prevframe_index) < pixel_count) {
+    if (prev_palette_plane == palette_plane && FFABS(motion_x + width*motion_y) < pixel_count) {
          avpriv_request_sample(s->avctx, "Overlapping copy");
          return ;
     }