diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-14 20:04:05 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-10-14 16:03:24 -0400 |
| commit | 2bc1e4fcb96c470e2ccb2a0a78a415d5eab960c8 (patch) | |
| tree | a0ad55204a3e72337a2ed53efbf7ce3100586f82 | |
| parent | 0582b8e3eabb4b7d6f637fcd294d6ae43d24b61a (diff) | |
| download | ffmpeg-2bc1e4fcb96c470e2ccb2a0a78a415d5eab960c8.tar.gz | |
indeo4: update AVCodecContext width/height on size change
Fixes CVE-2012-2787
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b146d74730ab9ec5abede9066f770ad851e45fbc)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/ivi_common.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index b36b31dfac..db33767820 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -823,6 +823,7 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size, avctx->release_buffer(avctx, &ctx->frame); ctx->frame.reference = 0; + avcodec_set_dimensions(avctx, ctx->planes[0].width, ctx->planes[0].height); if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); return result; |