From 0398b7cbd39abb049775d558ccc4ccf6dc01e92c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 22 Nov 2013 16:54:01 +0100 Subject: [PATCH] avcodec/hnm4video: check intraframe size Fixes hypothetical integer overflow with HNM4_CHUNK_ID_IZ Signed-off-by: Michael Niedermayer --- libavcodec/hnm4video.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index d2c4ce3a4c..b6ab60e2ae 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -373,6 +373,10 @@ static int hnm_decode_frame(AVCodecContext *avctx, void *data, hnm_update_palette(avctx, avpkt->data, avpkt->size); frame->palette_has_changed = 1; } else if (chunk_id == HNM4_CHUNK_ID_IZ) { + if (avpkt->size < 12) { + av_log(avctx, AV_LOG_ERROR, "packet too small\n"); + return AVERROR_INVALIDDATA; + } unpack_intraframe(avctx, avpkt->data + 12, avpkt->size - 12); memcpy(hnm->previous, hnm->current, hnm->width * hnm->height); if (hnm->version == 0x4a)