From f7d510b33ff33d2f5cb096017ee1c00f624cc138 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 21 Jul 2022 00:20:41 +0200
Subject: [PATCH] avcodec/ffv1dec: Fix AC_GOLOMB_RICE min size check

Found-by: mkver

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/ffv1dec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index d71584505d..4fe1738dea 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -884,9 +884,13 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
             return AVERROR_INVALIDDATA;
     } else {
         int w = avctx->width;
-        for (int i = 0; w > (1<<ff_log2_run[i]); i++)
+        int s = 1 + w / (1<<23);
+
+        w /= s;
+
+        for (i = 0; w > (1<<ff_log2_run[i]); i++)
             w -= ff_log2_run[i];
-        if (buf_size < (avctx->height + i + 6)/ 8)
+        if (buf_size < (avctx->height + i + 6) / 8 * s)
             return AVERROR_INVALIDDATA;
     }