RepoMirrors
/
mpv
mirror of https://github.com/mpv-player/mpv
1
0
Fork 0
Code Issues Releases Wiki Activity

mp_image: reject too large image sizes 

Larger sizes can introduce overflows, depending on the image format. In
the worst case, something larger than 16000x16000 with 8 bytes per pixel
will overflow 31 bits.

Maybe there should be a proper failure path instead of a hard crash, but
not yet. I imagine anything that sets a higher image size than a known
working size should be forced to call a function to check the size (much
like in ffmpeg/libavutil).
This commit is contained in:
wm4 2014-01-29 17:01:42 +01:00
parent 46c9dfe2e7
commit 8e61e9ed6e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
video/mp_image.c
View File

@ -175,6 +175,10 @@ static int mp_chroma_div_up(int size, int shift)
// Caller has to make sure this doesn't exceed the allocated plane data/strides.
void mp_image_set_size(struct mp_image *mpi, int w, int h)
{
// av_image_check_size has similar checks and triggers around 16000*16000
if (w >= (1 << 14) || h >= (1 << 14) || w < 0 || h < 0)
abort();
mpi->w = mpi->display_w = w;
mpi->h = mpi->display_h = h;
for (int n = 0; n < mpi->num_planes; n++) {