diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c index 1b607ac31ea6523bc3918809791d0da772cabce8..6e32c1540e55ac7b043ec690b926d062f48e690f 100644 --- a/libavcodec/rasc.c +++ b/libavcodec/rasc.c @@ -353,6 +353,8 @@ static int decode_dlta(AVCodecContext *avctx, compression = bytestream2_get_le32(gb); if (compression == 1) { + if (w * h * s->bpp * 3 < uncompressed_size) + return AVERROR_INVALIDDATA; ret = decode_zlib(avctx, avpkt, size, uncompressed_size); if (ret < 0) return ret;