@@ -83,7 +83,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
switch ((buf[0] >> 1) & 7) {
case 0: { // lzo compression
int outlen = c->decomp_size, inlen = buf_size - 2;
- if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) || outlen) {
+ int bpp = avctx->bits_per_coded_sample / 8;
+ int bugdelta = FFALIGN(avctx->width * bpp, 4) * avctx->height
+ - (avctx->width & ~3) * bpp * avctx->height;
+ if (av_lzo1x_decode(c->decomp_buf, &outlen, &buf[2], &inlen) || (outlen && outlen != bugdelta)) {
av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n");
return AVERROR_INVALIDDATA;
}
Alternatively the check could be simply made more tolerant Fixes: Ticket10227 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/cscd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)