aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2016-11-24 23:57:46 +0100
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2016-11-25 22:22:19 +0100
commitd147114b9de0aa443388b429aad3a71859bf2af6 (patch)
tree6f25e5febac82b0d490535ab2fe4736a5f718013
parentad8203662613b4d0cb8342b267f748eeb0e968a0 (diff)
downloadffmpeg-d147114b9de0aa443388b429aad3a71859bf2af6.tar.gz
mss2: only use error correction for matching block counts
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2 with coded_width/coded_height larger than width/height. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> (cherry picked from commit 2566ad98b01538ea589e5ee07b69fc566aadc348) Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
-rw-r--r--libavcodec/mss2.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index 1e24568128..581865b0b1 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -422,7 +422,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size,
ff_vc1_decode_blocks(v);
- ff_er_frame_end(&s->er);
+ if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) {
+ ff_er_frame_end(&s->er);
+ } else {
+ av_log(v->s.avctx, AV_LOG_WARNING,
+ "disabling error correction due to block count mismatch %dx%d != %dx%d\n",
+ v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height);
+ }
ff_mpv_frame_end(s);