diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-24 23:16:18 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-06 19:49:11 +0100 |
| commit | 07df40db6e9cc34127a13ad0553eb88314f82f7c (patch) | |
| tree | 64658c8917b909b729ee22030fd0e9a1c5366b5e | |
| parent | b24c2e59fec0342a57af86eaec3080e264894276 (diff) | |
| download | ffmpeg-07df40db6e9cc34127a13ad0553eb88314f82f7c.tar.gz | |
Check for invalid update parameters in vmd video decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e7aed1280ea14b60fceae04d71dfd03e1daf2d04)
(cherry picked from commit 1ed90c84f6ab75af91b08436cefb8ea464f8495b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vmdav.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index 1921c81ca2..a63afb0cdc 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -206,6 +206,16 @@ static void vmd_decode(VmdVideoContext *s) frame_y = AV_RL16(&s->buf[8]); frame_width = AV_RL16(&s->buf[10]) - frame_x + 1; frame_height = AV_RL16(&s->buf[12]) - frame_y + 1; + if (frame_x < 0 || frame_width < 0 || + frame_x >= s->avctx->width || + frame_width > s->avctx->width || + frame_x + frame_width > s->avctx->width) + return; + if (frame_y < 0 || frame_height < 0 || + frame_y >= s->avctx->height || + frame_height > s->avctx->height || + frame_y + frame_height > s->avctx->height) + return; if ((frame_width == s->avctx->width && frame_height == s->avctx->height) && (frame_x || frame_y)) { |