diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2015-06-26 15:57:16 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2015-07-22 13:05:35 +0200 |
| commit | 859ce02c9815b492da627d3098548b4f69bbc80e (patch) | |
| tree | 49c0a13dbcc0d937793e113c41f8a72c770f180b | |
| parent | aa3ec219e1a5cc0e96ddec6ea83312ec780448f5 (diff) | |
| download | ffmpeg-859ce02c9815b492da627d3098548b4f69bbc80e.tar.gz | |
h263: Always check both dimensions
CC: libav-stable@libav.org
Found-By: ago@gentoo.org
| -rw-r--r-- | libavcodec/ituh263dec.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c index dc3de30bb0..dd705c70d7 100644 --- a/libavcodec/ituh263dec.c +++ b/libavcodec/ituh263dec.c @@ -30,6 +30,7 @@ #include <limits.h> #include "libavutil/attributes.h" +#include "libavutil/imgutils.h" #include "libavutil/internal.h" #include "libavutil/mathematics.h" #include "avcodec.h" @@ -866,7 +867,7 @@ end: /* most is hardcoded. should extend to handle all h263 streams */ int ff_h263_decode_picture_header(MpegEncContext *s) { - int format, width, height, i; + int format, width, height, i, ret; uint32_t startcode; align_get_bits(&s->gb); @@ -917,8 +918,6 @@ int ff_h263_decode_picture_header(MpegEncContext *s) /* H.263v1 */ width = ff_h263_format[format][0]; height = ff_h263_format[format][1]; - if (!width) - return -1; s->pict_type = AV_PICTURE_TYPE_I + get_bits1(&s->gb); @@ -1071,6 +1070,9 @@ int ff_h263_decode_picture_header(MpegEncContext *s) s->qscale = get_bits(&s->gb, 5); } + if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0) + return ret; + s->mb_width = (s->width + 15) / 16; s->mb_height = (s->height + 15) / 16; s->mb_num = s->mb_width * s->mb_height; |