aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-11-29 15:56:05 +0100
committerMichael Niedermayer <michaelni@gmx.at>2014-11-28 20:27:41 +0100
commite74795e54108e6540adf180a5bd4f59023cd16a4 (patch)
treef3e4e01b620e5053f2c27e761e014d266ab3031f
parent473b0160962757c2fef9a6fedc3ff0ddeffdeef9 (diff)
downloadffmpeg-e74795e54108e6540adf180a5bd4f59023cd16a4.tar.gz
huffyuvdec: check width more completely, avoid out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 6abb9a901fca27da14d4fffbb01948288b5da3ba) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/huffyuv.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
index aad9168912..72dd52ee06 100644
--- a/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@ -555,7 +555,10 @@ s->bgr32=1;
default:
assert(0);
}
-
+ if (s->predictor == MEDIAN && avctx->pix_fmt == PIX_FMT_YUV422P && avctx->width%4) {
+ av_log(avctx, AV_LOG_ERROR, "width must be a multiple of 4 this colorspace and predictor\n");
+ return AVERROR_INVALIDDATA;
+ }
alloc_temp(s);
// av_log(NULL, AV_LOG_DEBUG, "pred:%d bpp:%d hbpp:%d il:%d\n", s->predictor, s->bitstream_bpp, avctx->bits_per_coded_sample, s->interlaced);