[FFmpeg-cvslog] xl: Fix the buffer size check

Luca Barbato git at videolan.org
Mon Jul 29 11:31:57 CEST 2013


ffmpeg | branch: master | Luca Barbato <lu_zero at gentoo.org> | Sat Jul 27 20:34:07 2013 +0200| [f1cb490d6d7391ff7e28cc376908cc98a652228d] | committer: Luca Barbato

xl: Fix the buffer size check

Also make it the first check.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f1cb490d6d7391ff7e28cc376908cc98a652228d
---

 libavcodec/xl.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libavcodec/xl.c b/libavcodec/xl.c
index 530a1bd..03df7c3 100644
--- a/libavcodec/xl.c
+++ b/libavcodec/xl.c
@@ -49,6 +49,11 @@ static int decode_frame(AVCodecContext *avctx,
     uint32_t val;
     int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0;
 
+    if (buf_size < avctx->width * avctx->height * sizeof(int32_t)) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if ((ret = ff_get_buffer(avctx, p, 0)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return ret;
@@ -62,11 +67,6 @@ static int decode_frame(AVCodecContext *avctx,
 
     stride = avctx->width - 4;
 
-    if (buf_size < avctx->width * avctx->height) {
-        av_log(avctx, AV_LOG_ERROR, "Packet is too small\n");
-        return AVERROR_INVALIDDATA;
-    }
-
     for (i = 0; i < avctx->height; i++) {
         /* lines are stored in reversed order */
         buf += stride;



More information about the ffmpeg-cvslog mailing list