diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2014-08-08 18:07:43 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2014-08-09 04:01:15 +0200 |
| commit | 0ab76ddf313eeab70d06619ae0376fd7dd40761b (patch) | |
| tree | 5b9cc612dea64c831a020c831ddd998c709cb796 /libavcodec/iff.c | |
| parent | 042c25f54bd25b52d2936b822be026450971a82d (diff) | |
| download | ffmpeg-0ab76ddf313eeab70d06619ae0376fd7dd40761b.tar.gz | |
avcodec: Introduce ff_get_buffer
Validate the image size there as is done in the other release
branches.
Bug-Id: CVE-2011-3935
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Diffstat (limited to 'libavcodec/iff.c')
| -rw-r--r-- | libavcodec/iff.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index b931e40213..4565724a8a 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -28,6 +28,7 @@ #include "libavutil/imgutils.h" #include "bytestream.h" #include "avcodec.h" +#include "internal.h" #include "get_bits.h" typedef struct { @@ -260,7 +261,7 @@ static int decode_frame_ilbm(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n"); return res; } - } else if ((res = avctx->get_buffer(avctx, &s->frame)) < 0) { + } else if ((res = ff_get_buffer(avctx, &s->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); return res; } else if (avctx->bits_per_coded_sample <= 8 && avctx->pix_fmt != PIX_FMT_GRAY8) { @@ -317,7 +318,7 @@ static int decode_frame_byterun1(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n"); return res; } - } else if ((res = avctx->get_buffer(avctx, &s->frame)) < 0) { + } else if ((res = ff_get_buffer(avctx, &s->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); return res; } else if (avctx->bits_per_coded_sample <= 8 && avctx->pix_fmt != PIX_FMT_GRAY8) { |