[FFmpeg-cvslog] avcodec/ffv1dec: Fix AC_GOLOMB_RICE min size check

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Thu Jul 21 00:20:41 2022 +0200| [f7d510b33ff33d2f5cb096017ee1c00f624cc138] | committer: Michael Niedermayer

avcodec/ffv1dec: Fix AC_GOLOMB_RICE min size check

Found-by: mkver

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f7d510b33ff33d2f5cb096017ee1c00f624cc138
---

 libavcodec/ffv1dec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index d71584505d..4fe1738dea 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -884,9 +884,13 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *rframe,
             return AVERROR_INVALIDDATA;
     } else {
         int w = avctx->width;
-        for (int i = 0; w > (1<<ff_log2_run[i]); i++)
+        int s = 1 + w / (1<<23);
+
+        w /= s;
+
+        for (i = 0; w > (1<<ff_log2_run[i]); i++)
             w -= ff_log2_run[i];
-        if (buf_size < (avctx->height + i + 6)/ 8)
+        if (buf_size < (avctx->height + i + 6) / 8 * s)
             return AVERROR_INVALIDDATA;
     }