diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-23 03:29:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-23 10:47:33 +0200 |
| commit | 4d87001096ff1d4e3ee6f88f8caddbd8ccb2c816 (patch) | |
| tree | aeadee096c906abf87b118861f51baafdc4bfdf6 | |
| parent | 70d54392f5015b9c6594fcae558f59f952501e3b (diff) | |
| download | ffmpeg-4d87001096ff1d4e3ee6f88f8caddbd8ccb2c816.tar.gz | |
vp8: fix crash due to skiped update_dimensions().
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vp8.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 07e5b61fcd..1ca5bab238 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -108,7 +108,7 @@ static void vp8_decode_flush(AVCodecContext *avctx) static int update_dimensions(VP8Context *s, int width, int height) { - if (width != s->avctx->width || + if (width != s->avctx->width || ((width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) && s->macroblocks_base || height != s->avctx->height) { if (av_image_check_size(width, height, 0, s->avctx)) return AVERROR_INVALIDDATA; @@ -333,7 +333,7 @@ static int decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_size) } if (!s->macroblocks_base || /* first frame */ - width != s->avctx->width || height != s->avctx->height) { + width != s->avctx->width || height != s->avctx->height || (width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) { if ((ret = update_dimensions(s, width, height)) < 0) return ret; } |