diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-10-28 15:26:42 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-11-28 18:53:11 +0100 |
| commit | 8c5c45b9e1b636c84ba4b928ac00fe2f78ac48be (patch) | |
| tree | cd3ce25c7a6da93b0ee5e72e184f3ccb2b8ca9c6 | |
| parent | dc2f4b72673a54590f74c6b39d18aa783e4a3b81 (diff) | |
| download | ffmpeg-8c5c45b9e1b636c84ba4b928ac00fe2f78ac48be.tar.gz | |
avcodec/dxa: check dimensions
Fixes out of array access
Fixes: asan_heap-oob_11222fb_21_020.dxa
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e70312dfc22c4e54d5716f28f28db8f99c74cc90)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/dxa.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/dxa.c b/libavcodec/dxa.c index 1d96f10ef4..ff7581f757 100644 --- a/libavcodec/dxa.c +++ b/libavcodec/dxa.c @@ -321,6 +321,11 @@ static av_cold int decode_init(AVCodecContext *avctx) { DxaDecContext * const c = avctx->priv_data; + if (avctx->width%4 || avctx->height%4) { + avpriv_request_sample(avctx, "dimensions are not a multiple of 4"); + return AVERROR_INVALIDDATA; + } + c->prev = av_frame_alloc(); if (!c->prev) return AVERROR(ENOMEM); |