diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index e5b2ea7ef0498d7e6b7f40765196c311b4bd6bda..d526d910da38b28a41eda725fdf9eed2e351ff98 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -900,6 +900,14 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx, av_dlog(avctx, "Frame dimensions changed!\n"); + if (width < 16 || width > 640 || + height < 16 || height > 480 || + width & 3 || height & 3) { + av_log(avctx, AV_LOG_ERROR, + "Invalid picture dimensions: %d x %d!\n", width, height); + return AVERROR_INVALIDDATA; + } + ctx->width = width; ctx->height = height;