diff --git a/libavcodec/jvdec.c b/libavcodec/jvdec.c index 8acd50a45c..a8c3336ccc 100644 --- a/libavcodec/jvdec.c +++ b/libavcodec/jvdec.c @@ -142,7 +142,7 @@ static int decode_frame(AVCodecContext *avctx, buf += 5; if (video_size) { - if (video_size < 0 || video_size > avpkt->size) { + if (video_size < 0 || video_size > avpkt->size - 5) { av_log(avctx, AV_LOG_ERROR, "video size %d invalid\n", video_size); return AVERROR_INVALIDDATA; } @@ -153,7 +153,7 @@ static int decode_frame(AVCodecContext *avctx, if (video_type == 0 || video_type == 1) { GetBitContext gb; - init_get_bits(&gb, buf, 8 * FFMIN(video_size, buf_end - buf)); + init_get_bits(&gb, buf, 8 * video_size); for (j = 0; j < avctx->height; j += 8) for (i = 0; i < avctx->width; i += 8)