diff --git a/libavcodec/exr.c b/libavcodec/exr.c index d277eb7858..85c925fb66 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1023,6 +1023,11 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size ) return AVERROR_INVALIDDATA; + if (ac_size <= 0) { + avpriv_request_sample(s->avctx, "Zero ac_size"); + return AVERROR_INVALIDDATA; + } + if ((uint64_t)rle_raw_size > INT_MAX) { avpriv_request_sample(s->avctx, "Too big rle_raw_size"); return AVERROR_INVALIDDATA;