diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-23 11:19:33 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-28 16:41:58 -0800 |
| commit | 8bc396fc0e8769a056375c1c211f389ce0e3ecc5 (patch) | |
| tree | 8597907e6e238118b77bb47320a1114be1cdf268 /libavcodec/vp5.c | |
| parent | bb6d5411e1e1a8e0608b1af1c4addee654dcbac5 (diff) | |
| download | ffmpeg-8bc396fc0e8769a056375c1c211f389ce0e3ecc5.tar.gz | |
vp56: error out on invalid stream dimensions.
Prevents crashes when playing corrupt vp5/6 streams.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/vp5.c')
| -rw-r--r-- | libavcodec/vp5.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index 999b183c7f..19079ffd0d 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -57,6 +57,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size, } rows = vp56_rac_gets(c, 8); /* number of stored macroblock rows */ cols = vp56_rac_gets(c, 8); /* number of stored macroblock cols */ + if (!rows || !cols) { + av_log(s->avctx, AV_LOG_ERROR, "Invalid size %dx%d\n", + cols << 4, rows << 4); + return 0; + } vp56_rac_gets(c, 8); /* number of displayed macroblock rows */ vp56_rac_gets(c, 8); /* number of displayed macroblock cols */ vp56_rac_gets(c, 2); |