calc_quant_matrix(s, buf[13]);
buf += 16;
+ if (width < 16 || height < 16) {
+ av_log(avctx, AV_LOG_ERROR, "Dimensions too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if (avctx->width != width || avctx->height != height) {
- if ((ret = av_image_check_size(width, height, 0, avctx)) < 0)
+ av_frame_unref(&s->last_frame);
+ if((width * height)/2048*7 > buf_end-buf)
+ return AVERROR_INVALIDDATA;
+ if ((ret = ff_set_dimensions(avctx, width, height)) < 0)
return ret;
- avcodec_set_dimensions(avctx, width, height);
- av_frame_unref(&s->last_frame);
}
- if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0) {
- av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+ if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0)
return ret;
- }
if (inter && !s->last_frame.data[0]) {
av_log(avctx, AV_LOG_WARNING, "Missing reference frame.\n");
tqi_calculate_qtable(s, buf[4]);
buf += 8;
- if (s->avctx->width!=s->width || s->avctx->height!=s->height)
- avcodec_set_dimensions(s->avctx, s->width, s->height);
+ ret = ff_set_dimensions(s->avctx, s->width, s->height);
+ if (ret < 0)
+ return ret;
- if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
- av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
+ if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
return ret;
- }
av_fast_padded_malloc(&t->bitstream_buf, &t->bitstream_buf_size,
buf_end - buf);