RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-24 00:02:52 +00:00
Code Issues Projects Releases Wiki Activity

dpx: perform width/height upgrade and av_image_check_size earlier to prevent segfault on malformed input

Browse Source 
Signed-off-by: Peter Ross <pross@xvid.org>
This commit is contained in:
Peter Ross 2012-11-26 22:45:07 +11:00 committed by Paul B Mahol
parent 5a3370816f
commit f2dc82b90f
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/dpx.c
View File

@ -104,6 +104,11 @@ static int decode_frame(AVCodecContext *avctx,
buf = avpkt->data + 0x304; buf = avpkt->data + 0x304;
w = read32(&buf, endian); w = read32(&buf, endian);
h = read32(&buf, endian); h = read32(&buf, endian);
if (av_image_check_size(w, h, 0, avctx))
return AVERROR(EINVAL);
if (w != avctx->width || h != avctx->height)
avcodec_set_dimensions(avctx, w, h);
// Need to end in 0x320 to read the descriptor // Need to end in 0x320 to read the descriptor
buf += 20; buf += 20;
@ -182,10 +187,6 @@ static int decode_frame(AVCodecContext *avctx,
if (s->picture.data[0]) if (s->picture.data[0])
avctx->release_buffer(avctx, &s->picture); avctx->release_buffer(avctx, &s->picture);
if (av_image_check_size(w, h, 0, avctx))
return -1;
if (w != avctx->width || h != avctx->height)
avcodec_set_dimensions(avctx, w, h);
if (avctx->get_buffer(avctx, p) < 0) { if (avctx->get_buffer(avctx, p) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return -1; return -1;