Check for invalid update parameters in vmd video decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commite7aed1280e
) (cherry picked from commit1ed90c84f6
) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:

committed by
Michael Niedermayer

parent
b24c2e59fe
commit
07df40db6e
@@ -206,6 +206,16 @@ static void vmd_decode(VmdVideoContext *s)
|
||||
frame_y = AV_RL16(&s->buf[8]);
|
||||
frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;
|
||||
frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;
|
||||
if (frame_x < 0 || frame_width < 0 ||
|
||||
frame_x >= s->avctx->width ||
|
||||
frame_width > s->avctx->width ||
|
||||
frame_x + frame_width > s->avctx->width)
|
||||
return;
|
||||
if (frame_y < 0 || frame_height < 0 ||
|
||||
frame_y >= s->avctx->height ||
|
||||
frame_height > s->avctx->height ||
|
||||
frame_y + frame_height > s->avctx->height)
|
||||
return;
|
||||
|
||||
if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&
|
||||
(frame_x || frame_y)) {
|
||||
|
Reference in New Issue
Block a user