From 6a326c22e1ff5d6f5a3b7979f8cbb0c3f5a0e754 Mon Sep 17 00:00:00 2001
From: vitor <vitor@9553f0bf-9b14-0410-a0b8-cfaf0461ba5b>
Date: Sun, 17 May 2009 09:48:12 +0000
Subject: [PATCH] Make TMV decoder check packet sizes before reading from it.

FATE test 295 might need updating.


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@18862 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
---
 libavcodec/tmv.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/tmv.c b/libavcodec/tmv.c
index 7bca0868c..5f746d5fb 100644
--- a/libavcodec/tmv.c
+++ b/libavcodec/tmv.c
@@ -52,6 +52,13 @@ static int tmv_decode_frame(AVCodecContext *avctx, void *data,
         return -1;
     }
 
+    if (avpkt->size < 2*char_rows*char_cols) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Input buffer too small, truncated sample?\n");
+        *data_size = 0;
+        return -1;
+    }
+
     tmv->pic.pict_type = FF_I_TYPE;
     tmv->pic.key_frame = 1;
     dst                = tmv->pic.data[0];
-- 
2.11.4.GIT