[FFmpeg-cvslog] avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu May  7 19:11:01 2015 +0200| [daea3209693f28328ca553fb33fdf8fc2ab42044] | committer: Michael Niedermayer

avcodec/txd: Fix input size checks for dxt1/3 for dimensions % 4 != 0

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=daea3209693f28328ca553fb33fdf8fc2ab42044
---

 libavcodec/txd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/txd.c b/libavcodec/txd.c
index ad1a015..d2884ad 100644
--- a/libavcodec/txd.c
+++ b/libavcodec/txd.c
@@ -94,12 +94,12 @@ static int txd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             if (!(flags & 1))
                 goto unsupported;
         case FF_S3TC_DXT1:
-            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 8)
+            if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 8)
                 return AVERROR_INVALIDDATA;
             ff_decode_dxt1(&gb, ptr, w, h, stride);
             break;
         case FF_S3TC_DXT3:
-            if (bytestream2_get_bytes_left(&gb) < (w/4) * (h/4) * 16)
+            if (bytestream2_get_bytes_left(&gb) < FF_CEIL_RSHIFT(w, 2) * FF_CEIL_RSHIFT(h, 2) * 16)
                 return AVERROR_INVALIDDATA;
             ff_decode_dxt3(&gb, ptr, w, h, stride);
             break;