This limit is possibly not reachable due to other restrictions on buffers but the decoder run table is too small beyond this, so explicitly check for it.
Unified · Split
| @@ -187,6 +187,9 @@ static int decode_slice_header(const FFV1Context *f, FFV1Context *fs) · 186 unmodified lines | ||
| 187 | 187 | || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height) |
| 188 | 188 | return -1; |
| 189 | 189 | |
| 190 | + if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23)) | |
| 191 | + return AVERROR_INVALIDDATA; | |
| 192 | + | |
| 190 | 193 | for (i = 0; i < f->plane_count; i++) { |
| 191 | 194 | PlaneContext * const p = &fs->plane[i]; |
| 192 | 195 | int idx = get_symbol(c, state, 0); |