avcodec/vcr1: Fix bitstream input size check
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 22 Oct 2013 12:40:49 +0000 (14:40 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 22 Oct 2013 16:09:20 +0000 (18:09 +0200)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vcr1.c

index c1393b5..7cb7405 100644 (file)
@@ -55,7 +55,7 @@ static int vcr1_decode_frame(AVCodecContext *avctx, void *data,
     const uint8_t *bytestream_end = bytestream + avpkt->size;
     int i, x, y, ret;
 
-    if(avpkt->size < 16 + avctx->height + avctx->width*avctx->height*5/8){
+    if(avpkt->size < 32 + avctx->height + avctx->width*avctx->height*5/8){
         av_log(avctx, AV_LOG_ERROR, "Insufficient input data.\n");
         return AVERROR(EINVAL);
     }