From 923f45430c3bb831d21c3cc52e721368c8a5a007 Mon Sep 17 00:00:00 2001 From: Peter Ross Date: Wed, 6 Nov 2024 07:58:59 +1100 Subject: [PATCH] avcodec/rv60: check init_get_bits8 return value Fixes CID 1634471 --- libavcodec/rv60dec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c index d68fa66fa7..86c7aefbca 100644 --- a/libavcodec/rv60dec.c +++ b/libavcodec/rv60dec.c @@ -2263,7 +2263,8 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread thread.avg_linesize[1] = 32; thread.avg_linesize[2] = 32; - init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size); + if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size)) < 0) + return ret; for (int cu_x = 0; cu_x < s->cu_width; cu_x++) { if ((s->avctx->active_thread_type & FF_THREAD_SLICE) && cu_y) @@ -2317,7 +2318,8 @@ static int rv60_decode_frame(AVCodecContext *avctx, AVFrame * frame, if (avpkt->size < header_size) return AVERROR_INVALIDDATA; - init_get_bits8(&gb, avpkt->data + header_size, avpkt->size - header_size); + if ((ret = init_get_bits8(&gb, avpkt->data + header_size, avpkt->size - header_size)) < 0) + return ret; if ((ret = read_frame_header(s, &gb, &width, &height)) < 0) return ret;