diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 8b7c0d9556..abd7981ac6 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -974,6 +974,11 @@ static int process_frame_obj(SANMVideoContext *ctx) } bytestream2_skip(&ctx->gb, 4); + if (w + FFMAX(left, 0) > ctx->avctx->width || h + FFMAX(top, 0) > ctx->avctx->height) { + avpriv_request_sample(ctx->avctx, "overly large frame\n"); + return AVERROR_PATCHWELCOME; + } + switch (codec) { case 1: case 3: