Fixes: writing over the end of the array Fixes: BIGSLEEP-434637586/payload Regression since: b22ce90d42
Unified · Split
| @@ -1601,6 +1601,11 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height) · 1600 unmodified lines | ||
| 1601 | 1601 | } |
| 1602 | 1602 | break; |
| 1603 | 1603 | case 2: |
| 1604 | + if (decoded_size > ctx->buf_size) { | |
| 1605 | + av_log(ctx->avctx, AV_LOG_ERROR, "Decoded size %u is too large.\n", decoded_size); | |
| 1606 | + return AVERROR_INVALIDDATA; | |
| 1607 | + } | |
| 1608 | + | |
| 1604 | 1609 | if (rle_decode(ctx, &ctx->gb, dst, decoded_size)) |
| 1605 | 1610 | return AVERROR_INVALIDDATA; |
| 1606 | 1611 | break; |