diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-22 19:44:00 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-22 20:23:36 +0100 |
| commit | b648b246f07a4b041dcefd7309af407c1b74862a (patch) | |
| tree | 10e39188016bbdaa7affdd61bd05316e3d627d61 | |
| parent | 7172175da6f8dfe6939e5366190a8066b78d71df (diff) | |
| download | ffmpeg-b648b246f07a4b041dcefd7309af407c1b74862a.tar.gz | |
diracdec: add missing check for pixel_range_index
This fixes an out-of-bounds read introduced in commit 0379603.
Reviewed-by: Kieran Kunhya <kierank@obe.tv>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavcodec/dirac.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/dirac.c b/libavcodec/dirac.c index 33cc96098c..faf5534e88 100644 --- a/libavcodec/dirac.c +++ b/libavcodec/dirac.c @@ -262,6 +262,9 @@ static int parse_source_parameters(AVDiracSeqHeader *dsh, GetBitContext *gb, dsh->bit_depth = luma_depth; + if (dsh->pixel_range_index < 2U) + return AVERROR_INVALIDDATA; + dsh->pix_fmt = dirac_pix_fmt[dsh->chroma_format][dsh->pixel_range_index-2]; avcodec_get_chroma_sub_sample(dsh->pix_fmt, &chroma_x_shift, &chroma_y_shift); if ((dsh->width % (1<<chroma_x_shift)) || (dsh->height % (1<<chroma_y_shift))) { |