diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 18:04:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 18:12:17 +0100 |
| commit | d1493d2ce5f598016adff8cda8484529a560fb0d (patch) | |
| tree | 2e423beaf44f5eb35027f30d5f19d866d2d3850b /libavcodec | |
| parent | 9eef41b848939a0a86582afdb45235e41612d9ba (diff) | |
| download | ffmpeg-d1493d2ce5f598016adff8cda8484529a560fb0d.tar.gz | |
theora: check that pix fmt is valid, fix null ptr deref
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vp3.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 2105bb588d..8a8c4cec2e 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -2175,6 +2175,10 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb) { skip_bits(gb, 5); /* keyframe frequency force */ avctx->pix_fmt = theora_pix_fmts[get_bits(gb, 2)]; + if (avctx->pix_fmt == AV_PIX_FMT_NONE) { + av_log(avctx, AV_LOG_ERROR, "Invalid pixel format\n"); + return AVERROR_INVALIDDATA; + } skip_bits(gb, 3); /* reserved */ } @@ -2349,7 +2353,8 @@ static av_cold int theora_decode_init(AVCodecContext *avctx) switch(ptype) { case 0x80: - theora_decode_header(avctx, &gb); + if (theora_decode_header(avctx, &gb) < 0) + return -1; break; case 0x81: // FIXME: is this needed? it breaks sometimes |