From 94b42da6963a88c9518039e0b8ca42b6aab8bfb3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 21 Apr 2012 21:29:48 +0200 Subject: [PATCH] xldec: Check that width is a multiple of 4 Fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/xl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/xl.c b/libavcodec/xl.c index 6cdb91b4c7..c8b0e06a41 100644 --- a/libavcodec/xl.c +++ b/libavcodec/xl.c @@ -52,6 +52,11 @@ static int decode_frame(AVCodecContext *avctx, uint32_t val; int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0; + if (avctx->width & 3) { + av_log(avctx, AV_LOG_ERROR, "width is not a multiple of 4\n"); + return AVERROR_INVALIDDATA; + } + if(p->data[0]) avctx->release_buffer(avctx, p);