Browse code

cinepak: check strip_size

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cea0c82d9b9771dfa2ac729c13c0d9e03ea352a7)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2011/11/17 01:21:42
Showing 1 changed files
... ...
@@ -366,6 +366,8 @@ static int cinepak_decode (CinepakContext *s)
366 366
         s->strips[i].x2 = s->avctx->width;
367 367
 
368 368
         strip_size = AV_RB24 (&s->data[1]) - 12;
369
+        if(strip_size < 0)
370
+            return -1;
369 371
         s->data   += 12;
370 372
         strip_size = ((s->data + strip_size) > eod) ? (eod - s->data) : strip_size;
371 373