From beac8235b92cdd322266e1709fbfe6f9e945e031 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 6 May 2007 15:25:04 +0000 Subject: [PATCH] fix possibly exploitable stack overflow with num_sprite_warping_points (found by reimar) Originally committed as revision 8919 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/h263.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/h263.c b/libavcodec/h263.c index 4db89e9700..e2ac5fc4fd 100644 --- a/libavcodec/h263.c +++ b/libavcodec/h263.c @@ -5665,6 +5665,11 @@ static int decode_vol_header(MpegEncContext *s, GetBitContext *gb){ skip_bits1(gb); /* marker */ } s->num_sprite_warping_points= get_bits(gb, 6); + if(s->num_sprite_warping_points > 3){ + av_log(s->avctx, AV_LOG_ERROR, "%d sprite_warping_points\n", s->num_sprite_warping_points); + s->num_sprite_warping_points= 0; + return -1; + } s->sprite_warping_accuracy = get_bits(gb, 2); s->sprite_brightness_change= get_bits1(gb); if(s->vol_sprite_usage==STATIC_SPRITE)