diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-11-18 19:10:21 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 15:47:57 +0100 |
| commit | 8ddc0b491d3c9c11c1e3d638fda51b4b604d32f4 (patch) | |
| tree | d935be834799604d28f3b0e926219a662dde2885 | |
| parent | 94aacaf5083313378c6105bd71db04ce8f62c058 (diff) | |
| download | ffmpeg-8ddc0b491d3c9c11c1e3d638fda51b4b604d32f4.tar.gz | |
svq1dec: call avcodec_set_dimensions() after dimensions changed.
Fixes NGS00148, CVE-2011-4579
Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6e24b9488e67849a28e64a8056e05f83cf439229)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 0eca0da06e40b73af495cc05fbcfaa030fcf78ea)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/svq1dec.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index 2aa28ab0b0..8c6f0c8f62 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -678,6 +678,7 @@ static int svq1_decode_frame(AVCodecContext *avctx, #endif return result; } + avcodec_set_dimensions(avctx, s->width, s->height); //FIXME this avoids some confusion for "B frames" without 2 references //this should be removed after libavcodec can handle more flexible picture types & ordering |