diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index d71584505d..4fe1738dea 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -884,9 +884,13 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe, return AVERROR_INVALIDDATA; } else { int w = avctx->width; - for (int i = 0; w > (1< (1<height + i + 6)/ 8) + if (buf_size < (avctx->height + i + 6) / 8 * s) return AVERROR_INVALIDDATA; }