diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-02-26 03:02:48 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-04-13 00:35:15 +0200 |
| commit | bafb13dc0fd60f49f613bf4c52ce88b91176755c (patch) | |
| tree | 2b3db28680a5e74874bf61029aad07620487b8a8 | |
| parent | bcc6d409283aebc114d674ace998016d04523ce3 (diff) | |
| download | ffmpeg-bafb13dc0fd60f49f613bf4c52ce88b91176755c.tar.gz | |
avcodec/utvideodec: Check subsample factors
Fixes: Out of array read
Fixes: heap_poc
Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7414d0bda7763f9bd69c26c068e482ab297c1c96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/utvideodec.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index fda5de0732..2cf9ce2855 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -28,6 +28,7 @@ #include <stdlib.h> #include "libavutil/intreadwrite.h" +#include "libavutil/pixdesc.h" #include "avcodec.h" #include "bswapdsp.h" #include "bytestream.h" @@ -824,6 +825,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, static av_cold int decode_init(AVCodecContext *avctx) { UtvideoContext * const c = avctx->priv_data; + int h_shift, v_shift; c->avctx = avctx; @@ -920,6 +922,13 @@ static av_cold int decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } + av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift); + if ((avctx->width & ((1<<h_shift)-1)) || + (avctx->height & ((1<<v_shift)-1))) { + avpriv_request_sample(avctx, "Odd dimensions"); + return AVERROR_PATCHWELCOME; + } + return 0; } |