Trap reference frames of invalid size

A corrupt bitstream could refer to a reference frame that has no size. Change-Id: I56c3b71a9dbb58b498e9969403e289c0e574f948
2013-06-11 14:24:53 -07:00 · 2013-06-11 14:24:53 -07:00 · 76e0c95dd9
commit 76e0c95dd9
parent 2bcc473602
1 changed files with 4 additions and 0 deletions
--- a/vp9/decoder/vp9_decodframe.c
+++ b/vp9/decoder/vp9_decodframe.c
@ -807,6 +807,10 @@ static void setup_frame_size_with_refs(VP9D_COMP *pbi,
  if (!found)
    read_frame_size(cm, rb, &width, &height);

+  if (!width || !height)
+    vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,
+                       "Referenced frame with invalid size");
+
  setup_display_size(pbi, rb);
  apply_frame_size(pbi, width, height);
 }