[FFmpeg-cvslog] lavc/bintext: check extradata size

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Jun  9 15:03:04 2012 +0200| [1b7a4c93a9df169c776ee973100f659386dd49e5] | committer: Michael Niedermayer

lavc/bintext: check extradata size

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1b7a4c93a9df169c776ee973100f659386dd49e5
---

 libavcodec/bintext.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/bintext.c b/libavcodec/bintext.c
index 463e4ac..e4507e5 100644
--- a/libavcodec/bintext.c
+++ b/libavcodec/bintext.c
@@ -54,6 +54,11 @@ static av_cold int decode_init(AVCodecContext *avctx)
         s->font_height = p[0];
         s->flags = p[1];
         p += 2;
+        if(avctx->extradata_size < 2 + (!!(s->flags & BINTEXT_PALETTE))*3*16
+                                     + (!!(s->flags & BINTEXT_FONT))*s->font_height*256) {
+            av_log(avctx, AV_LOG_ERROR, "not enough extradata\n");
+            return AVERROR_INVALIDDATA;
+        }
     } else {
         s->font_height = 8;
         s->flags = 0;