Alternatively the check could be simply made more tolerant
Fixes: Ticket10227
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/cscd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/cscd.c b/libavcodec/cscd.c
index b4ed3332a9..5d55f6e4d1 100644
--- a/libavcodec/cscd.c
+++ b/libavcodec/cscd.c
@@ -83,7 +83,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame
*rframe,
switch ((buf[0] >> 1) & 7) {
case 0: { // lzo compression
int outlen = c->decomp_size, inlen = buf_size - 2;
- if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) ||
outlen) {
+ int bpp = avctx->bits_per_coded_sample / 8;
+ int bugdelta = FFALIGN(avctx->width * bpp, 4) * avctx->height
+ - (avctx->width & ~3) * bpp * avctx->height;
+ if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) ||
(outlen && outlen != bugdelta)) {
av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n");
return AVERROR_INVALIDDATA;
}
--
2.17.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
