X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Foggparsedaala.c;h=3651ca188bd88700b3005f35cee94b4eb6f6550a;hb=1466379059201662c9f5685d51ea316447fbb113;hp=af6dce0a0d494444ffdf30765dc84c5600b8de8e;hpb=8076711d4cf9f66b74ac8af37f36c7fc7582b102;p=ffmpeg

diff --git a/libavformat/oggparsedaala.c b/libavformat/oggparsedaala.c
index af6dce0a0d4..3651ca188bd 100644
--- a/libavformat/oggparsedaala.c
+++ b/libavformat/oggparsedaala.c
@@ -42,6 +42,7 @@ static const struct DaalaPixFmtMap list_fmts[] = {
 
 typedef struct DaalaInfoHeader {
     int init_d;
+    int fpr;
     int gpshift;
     int gpmask;
     int version_maj;
@@ -122,10 +123,24 @@ static int daala_header(AVFormatContext *s, int idx)
 
         hdr->frame_duration = bytestream2_get_ne32(&gb);
         hdr->gpshift = bytestream2_get_byte(&gb);
-        hdr->gpmask  = (1 << hdr->gpshift) - 1;
+        if (hdr->gpshift >= 32) {
+            av_log(s, AV_LOG_ERROR, "Too large gpshift %d (>= 32).\n",
+                   hdr->gpshift);
+            return AVERROR_INVALIDDATA;
+        }
+        hdr->gpmask  = (1U << hdr->gpshift) - 1;
 
         hdr->format.depth  = 8 + 2*(bytestream2_get_byte(&gb)-1);
+
+        hdr->fpr = bytestream2_get_byte(&gb);
+
         hdr->format.planes = bytestream2_get_byte(&gb);
+        if (hdr->format.planes > 4) {
+            av_log(s, AV_LOG_ERROR,
+                   "Invalid number of planes %d in daala pixel format map.\n",
+                   hdr->format.planes);
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < hdr->format.planes; i++) {
             hdr->format.xdec[i] = bytestream2_get_byte(&gb);
             hdr->format.ydec[i] = bytestream2_get_byte(&gb);