aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2015-11-15 00:25:11 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2015-11-15 02:13:21 +0100
commit08940cd54596935e8780029d5c8ebcc0f409b58f (patch)
tree4ce924015b017558f6cead9326410c5633fd674b
parent196be9284a8d047254951c9f48b08b958349373b (diff)
downloadffmpeg-08940cd54596935e8780029d5c8ebcc0f409b58f.tar.gz
avcodec/dxtory: Fix input size check in dxtory_decode_v1_420()
Fixes out of array read Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 9caa9414ccf2dcf8aee2695377dee830a5024c82) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/dxtory.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dxtory.c b/libavcodec/dxtory.c
index 22e7b2f4eb..c12a193265 100644
--- a/libavcodec/dxtory.c
+++ b/libavcodec/dxtory.c
@@ -108,7 +108,7 @@ static int dxtory_decode_v1_420(AVCodecContext *avctx, AVFrame *pic,
uint8_t *Y1, *Y2, *U, *V;
int ret;
- if (src_size < avctx->width * avctx->height * 3LL / 2) {
+ if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) {
av_log(avctx, AV_LOG_ERROR, "packet too small\n");
return AVERROR_INVALIDDATA;
}