RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-15 02:58:01 +00:00
Code Issues Projects Releases Wiki Activity

vp7: bound checking in vp7_decode_frame_header

Browse Source 
CC: libav-stable@libav.org
This commit is contained in:
Federico Tomassetti 2015-08-13 15:35:53 +02:00 committed by Luca Barbato
parent f34b152eb7
commit 7bf9647264
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/vp8.c
View File

@ -480,6 +480,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
int width = s->avctx->width; int width = s->avctx->width;
int height = s->avctx->height; int height = s->avctx->height;
if (buf_size < 4) {
return AVERROR_INVALIDDATA;
}
s->profile = (buf[0] >> 1) & 7; s->profile = (buf[0] >> 1) & 7;
if (s->profile > 1) { if (s->profile > 1) {
avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile); avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);
@ -493,6 +497,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
buf += 4 - s->profile; buf += 4 - s->profile;
buf_size -= 4 - s->profile; buf_size -= 4 - s->profile;
if (buf_size < part1_size) {
return AVERROR_INVALIDDATA;
}
memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, sizeof(s->put_pixels_tab)); memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, sizeof(s->put_pixels_tab));
ff_vp56_init_range_decoder(c, buf, part1_size); ff_vp56_init_range_decoder(c, buf, part1_size);