[FFmpeg-cvslog] indeo2: fail if input buffer too small

[Alex Converse]

ffmpeg | branch: release/0.6 | Alex Converse <alex.converse at gmail.com> | Fri Sep  9 13:26:49 2011 -0700| [7f163e5a8749845b8fb25337a1b7023a8d9d4bc0] | committer: Reinhard Tartler

indeo2: fail if input buffer too small

(cherry picked from commit b7ce4f1d1c3add86ece7ca595ea6c4a10b471055)

Signed-off-by: Anton Khirnov <anton at khirnov.net>
Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7f163e5a8749845b8fb25337a1b7023a8d9d4bc0
---

 libavcodec/indeo2.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/libavcodec/indeo2.c b/libavcodec/indeo2.c
index 7060578..819c94b 100644
--- a/libavcodec/indeo2.c
+++ b/libavcodec/indeo2.c
@@ -156,6 +156,13 @@ static int ir2_decode_frame(AVCodecContext *avctx,
         return -1;
     }
 
+    start = 48; /* hardcoded for now */
+
+    if (start >= buf_size) {
+        av_log(s->avctx, AV_LOG_ERROR, "input buffer size too small (%d)\n", buf_size);
+        return AVERROR_INVALIDDATA;
+    }
+
     s->decode_delta = buf[18];
 
     /* decide whether frame uses deltas or not */
@@ -163,7 +170,6 @@ static int ir2_decode_frame(AVCodecContext *avctx,
     for (i = 0; i < buf_size; i++)
         buf[i] = av_reverse[buf[i]];
 #endif
-    start = 48; /* hardcoded for now */
 
     init_get_bits(&s->gb, buf + start, (buf_size - start) * 8);