@ -89,11 +89,6 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
unsigned i , j ;
CodeBook cb = { 0 } ;
if ( size > = INT_MAX / 34 | | get_bits_left ( gb ) < ( int ) size * 34 )
return cb ;
if ( size > = INT_MAX / sizeof ( MacroBlock ) )
return cb ;
cb . blocks = av_malloc ( size ? size * sizeof ( MacroBlock ) : 1 ) ;
if ( ! cb . blocks )
return cb ;
@ -225,7 +220,7 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
// represent a lower bound of the space needed for skipped superblocks. Non
// skipped SBs need more space.
if ( get_bits_left ( & gb ) < 64 + s - > num_superblocks * 23LL / 4320 )
return - 1 ;
return AVERROR_INVALIDDATA ;
frame_flags = get_bits_long ( & gb , 32 ) ;
frame_size = get_bits_long ( & gb , 32 ) ;
@ -276,9 +271,14 @@ static int escape124_decode_frame(AVCodecContext *avctx, AVFrame *frame,
}
av_freep ( & s - > codebooks [ i ] . blocks ) ;
if ( cb_size > = INT_MAX / 34 | | get_bits_left ( & gb ) < ( int ) cb_size * 34 )
return AVERROR_INVALIDDATA ;
if ( cb_size > = INT_MAX / sizeof ( MacroBlock ) )
return AVERROR_INVALIDDATA ;
s - > codebooks [ i ] = unpack_codebook ( & gb , cb_depth , cb_size ) ;
if ( ! s - > codebooks [ i ] . blocks )
return - 1 ;
return AVERROR ( ENOMEM ) ;
}
}