diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-02-26 03:02:48 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-07-08 19:45:45 +0200 |
| commit | 9c0593576454992e5739729623ca3ed1fe93d12e (patch) | |
| tree | 941b4cf9fcb57f61c4b321c7ce5bd7592f327448 | |
| parent | 36268aa8960e289596287a9a7d5d30ed13c90b86 (diff) | |
| download | ffmpeg-9c0593576454992e5739729623ca3ed1fe93d12e.tar.gz | |
avcodec/utvideodec: Check subsample factors
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7414d0bda7763f9bd69c26c068e482ab297c1c96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/utvideodec.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index a52082fb1b..3080d401fa 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -28,6 +28,7 @@ #include <stdlib.h> #include "libavutil/intreadwrite.h" +#include "libavutil/pixdesc.h" #include "avcodec.h" #include "bswapdsp.h" #include "bytestream.h" @@ -720,6 +721,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, static av_cold int decode_init(AVCodecContext *avctx) { UtvideoContext * const c = avctx->priv_data; + int h_shift, v_shift; c->avctx = avctx; @@ -815,6 +817,13 @@ static av_cold int decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } + av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift); + if ((avctx->width & ((1<<h_shift)-1)) || + (avctx->height & ((1<<v_shift)-1))) { + avpriv_request_sample(avctx, "Odd dimensions"); + return AVERROR_PATCHWELCOME; + } + return 0; } |