aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2016-02-26 12:59:08 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2016-02-27 13:11:52 +0100
commitd39b770aa27687da3b799252e614caa8b8686c13 (patch)
treef8b332a0629982ae28f4a0ee39bbf11687a0a104
parentbdf7093bd0cb78d39df8a32cfdc9188d7a960278 (diff)
downloadffmpeg-d39b770aa27687da3b799252e614caa8b8686c13.tar.gz
avcodec/utils: Check that the video data[] arrays are NULL on the input to get_buffer_internal()
This should return an error to the decoder if the struct it tried to getbuffer is dirty Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/utils.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index b5de8a10b1..5791ffaef6 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -870,6 +870,11 @@ static int get_buffer_internal(AVCodecContext *avctx, AVFrame *frame, int flags)
frame->height = FFMAX(avctx->height, AV_CEIL_RSHIFT(avctx->coded_height, avctx->lowres));
override_dimensions = 0;
}
+
+ if (frame->data[0] || frame->data[1] || frame->data[2] || frame->data[3]) {
+ av_log(avctx, AV_LOG_ERROR, "pic->data[*]!=NULL in get_buffer_internal\n");
+ return AVERROR(EINVAL);
+ }
}
ret = ff_decode_frame_props(avctx, frame);
if (ret < 0)