Fixes invalid reads.
Unified · Split
| @@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s) · 322 unmodified lines | |||
| 323 | return AVERROR_INVALIDDATA; | 323 | return AVERROR_INVALIDDATA; |
| 324 | } | 324 | } |
| 325 | 325 | ||
| 326 | if (header.header_size + 1 > s->size) { | ||
| 327 | av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n"); | ||
| 328 | return AVERROR_INVALIDDATA; | ||
| 329 | } | ||
| 330 | |||
| 326 | /* unscramble the header bytes with a XOR operation */ | 331 | /* unscramble the header bytes with a XOR operation */ |
| 327 | for (i = 1; i < header.header_size; i++) | 332 | for (i = 1; i < header.header_size; i++) |
| 328 | header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1]; | 333 | header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1]; |