diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-06 00:03:58 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-06 00:09:54 +0100 |
commit | 058e1f8dd71b30e3181a36cc66c5a278ebf835ba (patch) | |
tree | 84b98d6f26d2f28c7896ce12de7fbf2a7f3e7e73 /libavcodec/vc1dec.c | |
parent | d9293648147013403de729958ea4c19a5b6c40e4 (diff) | |
download | ffmpeg-058e1f8dd71b30e3181a36cc66c5a278ebf835ba.tar.gz |
vc1dec: odd sized sprites are unsupported
It should be easy to add support but without a sample we would
not know if they work.
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1dec.c')
-rw-r--r-- | libavcodec/vc1dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 585918cd7b..ff04508b84 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5292,6 +5292,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx) v->sprite_height > 1 << 14 || v->output_width > 1 << 14 || v->output_height > 1 << 14) return -1; + + if ((v->sprite_width&1) || (v->sprite_height&1)) { + av_log(avctx, AV_LOG_ERROR, "odd sprite\n"); + return AVERROR_PATCHWELCOME; + } } return 0; } |