cinepak: check strip_size
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 16 Nov 2011 16:21:42 +0000 (17:21 +0100)
committerMartin Storsjö <martin@martin.st>
Fri, 18 Nov 2011 09:58:43 +0000 (11:58 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Martin Storsjö <martin@martin.st>
libavcodec/cinepak.c

index e66a1c0..a858d6e 100644 (file)
@@ -370,6 +370,8 @@ static int cinepak_decode (CinepakContext *s)
         s->strips[i].x2 = s->avctx->width;
 
         strip_size = AV_RB24 (&s->data[1]) - 12;
+        if (strip_size < 0)
+            return -1;
         s->data   += 12;
         strip_size = ((s->data + strip_size) > eod) ? (eod - s->data) : strip_size;