[FFmpeg-devel] [PATCH 1/4] avcodec/rtv1: Check if the minimal size is available in decode_rtv1()

[Michael Niedermayer]

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/rtv1.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/rtv1.c b/libavcodec/rtv1.c
index 4b202e6a21..95fa9210d8 100644
--- a/libavcodec/rtv1.c
+++ b/libavcodec/rtv1.c
@@ -44,6 +44,8 @@ static int decode_rtv1(GetByteContext *gb, uint8_t *dst, ptrdiff_t linesize,
     uint8_t block[8] = { 0 };
     int run = 0;
 
+    if (bytestream2_get_bytes_left(gb) < (width / 4) * (height / 4) / 0xFFFF * 4)
+        return AVERROR_INVALIDDATA;
     for (int y = 0; y < height; y += 4) {
         for (int x = 0; x < width * 4; x += 16) {
             int mode = 0;
@@ -126,7 +128,9 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *p,
     dst = p->data[0] + p->linesize[0] * (avctx->coded_height - 1);
     linesize = -p->linesize[0];
 
-    decode_rtv1(&gb, dst, linesize, width, height, flags, dsp->dxt1_block);
+    ret = decode_rtv1(&gb, dst, linesize, width, height, flags, dsp->dxt1_block);
+    if (ret < 0)
+        return ret;
 
     p->pict_type = AV_PICTURE_TYPE_I;
     p->flags |= AV_FRAME_FLAG_KEY;
-- 
2.17.1