diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-04-08 22:12:12 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-04-18 22:05:55 +0200 |
| commit | 43039f9386d2d81eb39a9737b1c622bb83af36f8 (patch) | |
| tree | c488944f424932ee327027a3f6bdd183e5d3305a /libavcodec | |
| parent | d0c4d61c8bfdc074d6c20fb57760ac6b3200d9a9 (diff) | |
| download | ffmpeg-43039f9386d2d81eb39a9737b1c622bb83af36f8.tar.gz | |
svq1dec: check that the reference frame has the same dimensions as the current one
They can be different if the last keyframe failed to decode correctly.
Fixes possible invalid reads in such a case.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit b1bb8fb860b47e90dd67f0c5740698128fc82dcc)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/svq1dec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index 515604222b..19ff8d6594 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -692,7 +692,8 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data, } else { /* delta frame */ uint8_t *previous = s->prev->data[i]; - if (!previous) { + if (!previous || + s->prev->width != s->width || s->prev->height != s->height) { av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); result = AVERROR_INVALIDDATA; goto err; |