generic-library/vpx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vp8enc: Prevent out of bounds memory access.

Browse Source 
Prevent out of bounds access when attempting to increase frame size

Change-Id: I710c40c692802a72963c9680c2125da17f9060a9
This commit is contained in:
Alex Converse 2015-01-16 16:02:05 -08:00
parent fe2439703d
commit 581731a95f
3 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
vp8/encoder/onyx_if.c
View File

@ -1760,8 +1760,16 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf)
reset_temporal_layer_change(cpi, oxcf, prev_number_of_layers);
}
if (!cpi->initial_width)
{
cpi->initial_width = cpi->oxcf.Width;
cpi->initial_height = cpi->oxcf.Height;
}
cm->Width = cpi->oxcf.Width;
cm->Height = cpi->oxcf.Height;
assert(cm->Width <= cpi->initial_width);
assert(cm->Height <= cpi->initial_height);
/* TODO(jkoleszar): if an internal spatial resampling is active,
* and we downsize the input image, maybe we should clear the

3
vp8/encoder/onyx_int.h
View File

@ -665,6 +665,9 @@ typedef struct VP8_COMP
int droppable;
int initial_width;
int initial_height;
#if CONFIG_TEMPORAL_DENOISING
VP8_DENOISER denoiser;
#endif

11
vp8/vp8_cx_iface.c
View File

@ -447,9 +447,14 @@ static vpx_codec_err_t vp8e_set_config(vpx_codec_alg_priv_t *ctx,
{
vpx_codec_err_t res;
if (((cfg->g_w != ctx->cfg.g_w) || (cfg->g_h != ctx->cfg.g_h))
&& (cfg->g_lag_in_frames > 1 || cfg->g_pass != VPX_RC_ONE_PASS))
ERROR("Cannot change width or height after initialization");
if (cfg->g_w != ctx->cfg.g_w || cfg->g_h != ctx->cfg.g_h)
{
if (cfg->g_lag_in_frames > 1 || cfg->g_pass != VPX_RC_ONE_PASS)
ERROR("Cannot change width or height after initialization");
if ((ctx->cpi->initial_width && (int)cfg->g_w > ctx->cpi->initial_width) ||
(ctx->cpi->initial_height && (int)cfg->g_h > ctx->cpi->initial_height))
ERROR("Cannot increast width or height larger than their initial values");
}
/* Prevent increasing lag_in_frames. This check is stricter than it needs
* to be -- the limit is not increasing past the first lag_in_frames