[FFmpeg-cvslog] avcodec/hnm4video: check intraframe size

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Nov 22 16:54:01 2013 +0100| [0398b7cbd39abb049775d558ccc4ccf6dc01e92c] | committer: Michael Niedermayer

avcodec/hnm4video: check intraframe size

Fixes hypothetical integer overflow with HNM4_CHUNK_ID_IZ

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0398b7cbd39abb049775d558ccc4ccf6dc01e92c
---

 libavcodec/hnm4video.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c
index d2c4ce3..b6ab60e 100644
--- a/libavcodec/hnm4video.c
+++ b/libavcodec/hnm4video.c
@@ -373,6 +373,10 @@ static int hnm_decode_frame(AVCodecContext *avctx, void *data,
         hnm_update_palette(avctx, avpkt->data, avpkt->size);
         frame->palette_has_changed = 1;
     } else if (chunk_id == HNM4_CHUNK_ID_IZ) {
+        if (avpkt->size < 12) {
+            av_log(avctx, AV_LOG_ERROR, "packet too small\n");
+            return AVERROR_INVALIDDATA;
+        }
         unpack_intraframe(avctx, avpkt->data + 12, avpkt->size - 12);
         memcpy(hnm->previous, hnm->current, hnm->width * hnm->height);
         if (hnm->version == 0x4a)