diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-02-26 12:59:08 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-02-27 13:11:52 +0100 |
| commit | d39b770aa27687da3b799252e614caa8b8686c13 (patch) | |
| tree | f8b332a0629982ae28f4a0ee39bbf11687a0a104 | |
| parent | bdf7093bd0cb78d39df8a32cfdc9188d7a960278 (diff) | |
| download | ffmpeg-d39b770aa27687da3b799252e614caa8b8686c13.tar.gz | |
avcodec/utils: Check that the video data[] arrays are NULL on the input to get_buffer_internal()
This should return an error to the decoder if the struct it tried to getbuffer is dirty
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/utils.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c index b5de8a10b1..5791ffaef6 100644 --- a/libavcodec/utils.c +++ b/libavcodec/utils.c @@ -870,6 +870,11 @@ static int get_buffer_internal(AVCodecContext *avctx, AVFrame *frame, int flags) frame->height = FFMAX(avctx->height, AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres)); override_dimensions = 0; } + + if (frame->data[0] || frame->data[1] || frame->data[2] || frame->data[3]) { + av_log(avctx, AV_LOG_ERROR, "pic->data[*]!=NULL in get_buffer_internal\n"); + return AVERROR(EINVAL); + } } ret = ff_decode_frame_props(avctx, frame); if (ret < 0) |