aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/vc1dec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-03-06 00:03:58 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-03-06 00:09:54 +0100
commit058e1f8dd71b30e3181a36cc66c5a278ebf835ba (patch)
tree84b98d6f26d2f28c7896ce12de7fbf2a7f3e7e73 /libavcodec/vc1dec.c
parentd9293648147013403de729958ea4c19a5b6c40e4 (diff)
downloadffmpeg-058e1f8dd71b30e3181a36cc66c5a278ebf835ba.tar.gz
vc1dec: odd sized sprites are unsupported
It should be easy to add support but without a sample we would not know if they work. Fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1dec.c')
-rw-r--r--libavcodec/vc1dec.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 585918cd7b..ff04508b84 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -5292,6 +5292,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
v->sprite_height > 1 << 14 ||
v->output_width > 1 << 14 ||
v->output_height > 1 << 14) return -1;
+
+ if ((v->sprite_width&1) || (v->sprite_height&1)) {
+ av_log(avctx, AV_LOG_ERROR, "odd sprite\n");
+ return AVERROR_PATCHWELCOME;
+ }
}
return 0;
}