Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer authored on 2011/11/15 02:01:13... | ... |
@@ -1836,7 +1836,8 @@ static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *data_size, |
1836 | 1836 |
break; |
1837 | 1837 |
|
1838 | 1838 |
data_unit_size = AV_RB32(buf+buf_idx+5); |
1839 |
- if (buf_idx + data_unit_size > buf_size) { |
|
1839 |
+ if (buf_idx + data_unit_size > buf_size || !data_unit_size) { |
|
1840 |
+ if(buf_idx + data_unit_size > buf_size) |
|
1840 | 1841 |
av_log(s->avctx, AV_LOG_ERROR, |
1841 | 1842 |
"Data unit with size %d is larger than input buffer, discarding\n", |
1842 | 1843 |
data_unit_size); |