diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-21 21:29:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-21 21:30:23 +0200 |
| commit | 94b42da6963a88c9518039e0b8ca42b6aab8bfb3 (patch) | |
| tree | 031b63f4d515d84b72e355fecea964d06f7e63ee /libavcodec/xl.c | |
| parent | 80d51680b2a21139ddc1b7335952e6f0e9aa43ac (diff) | |
| download | ffmpeg-94b42da6963a88c9518039e0b8ca42b6aab8bfb3.tar.gz | |
xldec: Check that width is a multiple of 4
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/xl.c')
| -rw-r--r-- | libavcodec/xl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/xl.c b/libavcodec/xl.c index 6cdb91b4c7..c8b0e06a41 100644 --- a/libavcodec/xl.c +++ b/libavcodec/xl.c @@ -52,6 +52,11 @@ static int decode_frame(AVCodecContext *avctx, uint32_t val; int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0; + if (avctx->width & 3) { + av_log(avctx, AV_LOG_ERROR, "width is not a multiple of 4\n"); + return AVERROR_INVALIDDATA; + } + if(p->data[0]) avctx->release_buffer(avctx, p); |