diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-14 02:36:22 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-19 03:51:39 +0100 |
| commit | c00d40095bf2039b028fbe2a65e05ee33a12ca81 (patch) | |
| tree | 4eb1c46a7cf44df42b81f81ef4ef87f2c5930b9d | |
| parent | 896c8e38915cc452556c50c7c2f58d72b898f2fc (diff) | |
| download | ffmpeg-c00d40095bf2039b028fbe2a65e05ee33a12ca81.tar.gz | |
avcodec/ivi: Check image dimensions
Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit df91aa034b82b77a3c4e01791f4a2b2ff6c82066)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/ivi_common.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index d27eff2c3e..526dd83f0a 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -30,6 +30,7 @@ #define BITSTREAM_READER_LE #include "libavutil/attributes.h" +#include "libavutil/imgutils.h" #include "libavutil/timer.h" #include "avcodec.h" #include "get_bits.h" @@ -310,7 +311,7 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg, ivi_free_buffers(planes); - if (cfg->pic_width < 1 || cfg->pic_height < 1 || + if (av_image_check_size(cfg->pic_width, cfg->pic_height, 0, NULL) < 0 || cfg->luma_bands < 1 || cfg->chroma_bands < 1) return AVERROR_INVALIDDATA; |