Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavcodec/vp8.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index 62b9f8bc2d..f6120aa67e 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -505,6 +505,9 @@ static int vp7_fade_frame(VP8Context *s, VP56RangeCoder *c)
int beta = (int8_t) vp8_rac_get_uint(c, 8);
int ret;
+ if (c->end <= c->buffer && c->bits >= 0)
+ return AVERROR_INVALIDDATA;
+
if (!s->keyframe && (alpha || beta)) {
int width = s->mb_width * 16;
int height = s->mb_height * 16;
--
2.18.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
