RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

sanm: check image dimensions before using them 

Avoids integer overflows and out of array accesses.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-22 21:30:20 +01:00
parent c4274d118b
commit 49b729d3af
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/sanm.c
View File

@ -26,6 +26,7 @@
#include "bytestream.h"
#include "internal.h"
#include "libavutil/bswap.h"
#include "libavutil/imgutils.h"
#include "libavcodec/dsputil.h"
#include "sanm_data.h"
@ -716,8 +717,11 @@ static int process_frame_obj(SANMVideoContext *ctx)
h = bytestream2_get_le16u(&ctx->gb);
if (ctx->width < left + w || ctx->height < top + h) {
ctx->avctx->width = FFMAX(left + w, ctx->width);
ctx->avctx->height = FFMAX(top + h, ctx->height);
if (av_image_check_size(FFMAX(left + w, ctx->width),
FFMAX(top + h, ctx->height), 0, ctx->avctx) < 0)
return AVERROR_INVALIDDATA;
avcodec_set_dimensions(ctx->avctx, FFMAX(left + w, ctx->width),
FFMAX(top + h, ctx->height));
init_sizes(ctx, left + w, top + h);
if (init_buffers(ctx)) {
av_log(ctx->avctx, AV_LOG_ERROR, "error resizing buffers\n");