rv10: Validate the dimensions set from the container
diff mbox

Message ID 1379410138-13422-1-git-send-email-martin@martin.st
State Committed
Commit 5372cda67109848d22146289e401669266217e80
Headers show

Commit Message

Martin Storsjö Sept. 17, 2013, 9:28 a.m. 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavcodec/rv10.c |    3 +++
 1 file changed, 3 insertions(+)

Comments

Martin Storsjö Sept. 18, 2013, 7:29 p.m. | #1 
On Tue, 17 Sep 2013, Martin Storsjö wrote:

> Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC: libav-stable@libav.org
> ---
> libavcodec/rv10.c |    3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
> index 0d3b648..2c76bb2 100644
> --- a/libavcodec/rv10.c
> +++ b/libavcodec/rv10.c
> @@ -432,6 +432,9 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
>         av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
>         return AVERROR_INVALIDDATA;
>     }
> +    if ((ret = av_image_check_size(avctx->coded_width,
> +                                   avctx->coded_height, 0, avctx)) < 0)
> +        return ret;
>
>     ff_MPV_decode_defaults(s);
>
> -- 
> 1.7.9.5

Ok'd by Luca on irc.

// Martin

Patch
diff mbox 

diff --git a/libavcodec/rv10.c b/libavcodec/rv10.c
index 0d3b648..2c76bb2 100644
--- a/libavcodec/rv10.c
+++ b/libavcodec/rv10.c
@@ -432,6 +432,9 @@  static av_cold int rv10_decode_init(AVCodecContext *avctx)
         av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
         return AVERROR_INVALIDDATA;
     }
+    if ((ret = av_image_check_size(avctx->coded_width,
+                                   avctx->coded_height, 0, avctx)) < 0)
+        return ret;
 
     ff_MPV_decode_defaults(s);