rv10: Validate the dimensions set from the container
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 5372cda671
)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:

committed by
Luca Barbato

parent
00516b5491
commit
0b0f1cd44e
@@ -426,12 +426,15 @@ static av_cold int rv10_decode_init(AVCodecContext *avctx)
|
|||||||
RVDecContext *rv = avctx->priv_data;
|
RVDecContext *rv = avctx->priv_data;
|
||||||
MpegEncContext *s = &rv->m;
|
MpegEncContext *s = &rv->m;
|
||||||
static int done=0;
|
static int done=0;
|
||||||
int major_ver, minor_ver, micro_ver;
|
int major_ver, minor_ver, micro_ver, ret;
|
||||||
|
|
||||||
if (avctx->extradata_size < 8) {
|
if (avctx->extradata_size < 8) {
|
||||||
av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
|
av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
if ((ret = av_image_check_size(avctx->coded_width,
|
||||||
|
avctx->coded_height, 0, avctx)) < 0)
|
||||||
|
return ret;
|
||||||
|
|
||||||
ff_MPV_decode_defaults(s);
|
ff_MPV_decode_defaults(s);
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user