From 4d87001096ff1d4e3ee6f88f8caddbd8ccb2c816 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Apr 2012 03:29:48 +0200 Subject: [PATCH] vp8: fix crash due to skiped update_dimensions(). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/vp8.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 07e5b61fcd..1ca5bab238 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -108,7 +108,7 @@ static void vp8_decode_flush(AVCodecContext *avctx) static int update_dimensions(VP8Context *s, int width, int height) { - if (width != s->avctx->width || + if (width != s->avctx->width || ((width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) && s->macroblocks_base || height != s->avctx->height) { if (av_image_check_size(width, height, 0, s->avctx)) return AVERROR_INVALIDDATA; @@ -333,7 +333,7 @@ static int decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_size) } if (!s->macroblocks_base || /* first frame */ - width != s->avctx->width || height != s->avctx->height) { + width != s->avctx->width || height != s->avctx->height || (width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) { if ((ret = update_dimensions(s, width, height)) < 0) return ret; }