diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-22 21:30:20 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-07 01:00:01 +0100 |
| commit | 8eda88868399de00806cf21a966d9660db4ae9b4 (patch) | |
| tree | 1f22836f104f65d86a8d85fc990f8134c4bcb251 | |
| parent | f3144b0cc69490fa81d1f499e24d4b0bc1c63c0e (diff) | |
| download | ffmpeg-8eda88868399de00806cf21a966d9660db4ae9b4.tar.gz | |
sanm: check image dimensions before using them
Avoids integer overflows and out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 49b729d3af8464de431362e6c5b3027102bc2f88)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/sanm.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 3736bd74ec..e2d8c0dd2d 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -25,6 +25,7 @@ #include "avcodec.h" #include "bytestream.h" #include "libavutil/bswap.h" +#include "libavutil/imgutils.h" #include "libavcodec/dsputil.h" #include "sanm_data.h" @@ -715,8 +716,11 @@ static int process_frame_obj(SANMVideoContext *ctx) h = bytestream2_get_le16u(&ctx->gb); if (ctx->width < left + w || ctx->height < top + h) { - ctx->avctx->width = FFMAX(left + w, ctx->width); - ctx->avctx->height = FFMAX(top + h, ctx->height); + if (av_image_check_size(FFMAX(left + w, ctx->width), + FFMAX(top + h, ctx->height), 0, ctx->avctx) < 0) + return AVERROR_INVALIDDATA; + avcodec_set_dimensions(ctx->avctx, FFMAX(left + w, ctx->width), + FFMAX(top + h, ctx->height)); init_sizes(ctx, left + w, top + h); if (init_buffers(ctx)) { av_log(ctx->avctx, AV_LOG_ERROR, "error resizing buffers\n"); |