Unified · Split
| @@ -149,6 +149,9 @@ static int hq_decode_frame(HQContext *ctx, AVFrame *pic, GetByteContext *gbc, · 148 unmodified lines | ||
| 149 | 149 | av_log(ctx->avctx, AV_LOG_VERBOSE, "HQ Profile %d\n", prof_num); |
| 150 | 150 | } |
| 151 | 151 | |
| 152 | + if (bytestream2_get_bytes_left(gbc) < 3 * (profile->num_slices + 1)) | |
| 153 | + return AVERROR_INVALIDDATA; | |
| 154 | + | |
| 152 | 155 | ctx->avctx->coded_width = FFALIGN(profile->width, 16); |
| 153 | 156 | ctx->avctx->coded_height = FFALIGN(profile->height, 16); |
| 154 | 157 | ctx->avctx->width = profile->width; |