Revision 3777ea13 libavcodec/dpx.c

View differences:

libavcodec/dpx.c
68 68

  
69 69
    unsigned int rgbBuffer;
70 70

  
71
    if (avpkt->size <= 0x324) {
72
        av_log(avctx, AV_LOG_ERROR, "Packet too small for DPX header\n");
73
        return AVERROR_INVALIDDATA;
74
    }
75

  
71 76
    magic_num = AV_RB32(buf);
72 77
    buf += 4;
73 78

  
......
83 88
    }
84 89

  
85 90
    offset = read32(&buf, endian);
91
    if (avpkt->size <= offset) {
92
        av_log(avctx, AV_LOG_ERROR, "Invalid data start offset\n");
93
        return AVERROR_INVALIDDATA;
94
    }
86 95
    // Need to end in 0x304 offset from start of file
87 96
    buf = avpkt->data + 0x304;
88 97
    w = read32(&buf, endian);
......
122 131
        case 10:
123 132
            avctx->pix_fmt = PIX_FMT_RGB48;
124 133
            target_packet_size = 6;
125
            source_packet_size = elements * 2;
134
            source_packet_size = 4;
126 135
            break;
127 136
        case 12:
128 137
        case 16:
......
156 165
    ptr    = p->data[0];
157 166
    stride = p->linesize[0];
158 167

  
168
    if (source_packet_size*avctx->width*avctx->height > buf_end - buf) {
169
        av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");
170
        return -1;
171
    }
159 172
    switch (bits_per_color) {
160 173
        case 10:
161 174
            for (x = 0; x < avctx->height; x++) {
......
173 186
        case 8:
174 187
        case 12: // Treat 12-bit as 16-bit
175 188
        case 16:
176
            if (source_packet_size*avctx->width*avctx->height > buf_end - buf) {
177
                av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");
178
                return -1;
179
            }
180 189
            if (source_packet_size == target_packet_size) {
181 190
                for (x = 0; x < avctx->height; x++) {
182 191
                    memcpy(ptr, buf, target_packet_size*avctx->width);

Also available in: Unified diff