X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavformat%2Fswfdec.c;h=b91560c56ce3d1dcb217f5b5be8c9e5f3edf8243;hb=a246fef163387c0d79830a9bdf408443a9aba1c1;hp=fa2435e0a0c5e94291800ec89bec71927fd2d631;hpb=1ad3ffadd9102b4a752c634e401a1438eba9d416;p=ffmpeg

diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index fa2435e0a0c..b91560c56ce 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -119,10 +119,10 @@ retry:
     z->avail_out = buf_size;
 
     ret = inflate(z, Z_NO_FLUSH);
-    if (ret < 0)
-        return AVERROR(EINVAL);
     if (ret == Z_STREAM_END)
         return AVERROR_EOF;
+    if (ret != Z_OK)
+        return AVERROR(EINVAL);
 
     if (buf_size - z->avail_out == 0)
         goto retry;
@@ -395,6 +395,12 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
             pkt->pos = pos;
             pkt->stream_index = st->index;
 
+            if (linesize * height > pkt->size) {
+                res = AVERROR_INVALIDDATA;
+                av_packet_unref(pkt);
+                goto bitmap_end;
+            }
+
             switch (bmp_fmt) {
             case 3:
                 pix_fmt = AV_PIX_FMT_PAL8;
@@ -422,10 +428,6 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
             } else
                 st->codecpar->format = pix_fmt;
 
-            if (linesize * height > pkt->size) {
-                res = AVERROR_INVALIDDATA;
-                goto bitmap_end;
-            }
             memcpy(pkt->data, buf + colormapsize*colormapbpp, linesize * height);
 
             res = pkt->size;
@@ -516,7 +518,7 @@ bitmap_end_skip:
         }
     skip:
         if(len<0)
-            av_log(s, AV_LOG_WARNING, "Cliping len %d\n", len);
+            av_log(s, AV_LOG_WARNING, "Clipping len %d\n", len);
         len = FFMAX(0, len);
         avio_skip(pb, len);
     }