This limit is possibly not reachable due to other restrictions on buffers but the decoder run table is too small beyond this, so explicitly check for it.
Unified · Split
| @@ -187,6 +187,9 @@ static int decode_slice_header(const FFV1Context *f, FFV1Context *fs) · 186 unmodified lines | |||
| 187 | || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height) | 187 | || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height) |
| 188 | return -1; | 188 | return -1; |
| 189 | 189 | ||
| 190 | if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23)) | ||
| 191 | return AVERROR_INVALIDDATA; | ||
| 192 | |||
| 190 | for (i = 0; i < f->plane_count; i++) { | 193 | for (i = 0; i < f->plane_count; i++) { |
| 191 | PlaneContext * const p = &fs->plane[i]; | 194 | PlaneContext * const p = &fs->plane[i]; |
| 192 | int idx = get_symbol(c, state, 0); | 195 | int idx = get_symbol(c, state, 0); |