diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-24 23:57:46 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2016-11-27 00:28:08 +0100 |
| commit | 072246993acb9ce22f88e3df697f78dba61fcdd3 (patch) | |
| tree | 20149c9d775d22a466c16ee001e656b8e885e351 /libavcodec | |
| parent | 5d1502d4b68c458522e5a6fc446d5b0e5f88bffb (diff) | |
| download | ffmpeg-072246993acb9ce22f88e3df697f78dba61fcdd3.tar.gz | |
mss2: only use error correction for matching block counts
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 2566ad98b01538ea589e5ee07b69fc566aadc348)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mss2.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index d255dd4337..fdc07168c7 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -422,7 +422,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size, ff_vc1_decode_blocks(v); - ff_er_frame_end(&s->er); + if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) { + ff_er_frame_end(&s->er); + } else { + av_log(v->s.avctx, AV_LOG_WARNING, + "disabling error correction due to block count mismatch %dx%d != %dx%d\n", + v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height); + } ff_mpv_frame_end(s); |