RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge commit 'f5d46d332258dcd8ca623019ece1d5e5bb74142b' 

* commit 'f5d46d332258dcd8ca623019ece1d5e5bb74142b':
  vmnc: check that subrectangles fit into their containing rectangles

See 6ba02602aa

This merge keeps our condition against w-i and h-j instead of bw and bh.
One may be more correct than the other, but I'm keeping our behaviour
here for safety reasons.

The style and formatting is merged.

Merged-by: Clément Bœsch <u@pkh.me>
This commit is contained in:
Clément Bœsch 2017-03-19 17:24:49 +01:00
parent 01e188762f f5d46d3322
commit 1080b7162f
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/vmnc.c
View File

@ -287,17 +287,24 @@ static int decode_hextile(VmncContext *c, uint8_t* dst, GetByteContext *gb,
return AVERROR_INVALIDDATA;
}
for (k = 0; k < rects; k++) {
int rect_x, rect_y, rect_w, rect_h;
if (color)
fg = vmnc_get_pixel(gb, bpp, c->bigendian);
xy = bytestream2_get_byte(gb);
wh = bytestream2_get_byte(gb);
if ( (xy >> 4) + (wh >> 4) + 1 > w - i
|| (xy & 0xF) + (wh & 0xF)+1 > h - j) {
rect_x = xy >> 4;
rect_y = xy & 0xF;
rect_w = (wh >> 4) + 1;
rect_h = (wh & 0xF) + 1;
if (rect_x + rect_w > w - i || rect_y + rect_h > h - j) {
av_log(c->avctx, AV_LOG_ERROR, "Rectangle outside picture\n");
return AVERROR_INVALIDDATA;
}
paint_rect(dst2, xy >> 4, xy & 0xF,
(wh>>4)+1, (wh & 0xF)+1, fg, bpp, stride);
paint_rect(dst2, rect_x, rect_y,
rect_w, rect_h, fg, bpp, stride);
}
}
}