[FFmpeg-cvslog] xl: Fix the buffer size check
Luca Barbato
git at videolan.org
Mon Jul 29 11:31:57 CEST 2013
ffmpeg | branch: master | Luca Barbato <lu_zero at gentoo.org> | Sat Jul 27 20:34:07 2013 +0200| [f1cb490d6d7391ff7e28cc376908cc98a652228d] | committer: Luca Barbato
xl: Fix the buffer size check
Also make it the first check.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f1cb490d6d7391ff7e28cc376908cc98a652228d
---
libavcodec/xl.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/xl.c b/libavcodec/xl.c
index 530a1bd..03df7c3 100644
--- a/libavcodec/xl.c
+++ b/libavcodec/xl.c
@@ -49,6 +49,11 @@ static int decode_frame(AVCodecContext *avctx,
uint32_t val;
int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0;
+ if (buf_size < avctx->width * avctx->height * sizeof(int32_t)) {
+ av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return ret;
@@ -62,11 +67,6 @@ static int decode_frame(AVCodecContext *avctx,
stride = avctx->width - 4;
- if (buf_size < avctx->width * avctx->height) {
- av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
- return AVERROR_INVALIDDATA;
- }
-
for (i = 0; i < avctx->height; i++) {
/* lines are stored in reversed order */
buf += stride;
More information about the ffmpeg-cvslog
mailing list