[FFmpeg-cvslog] indeo5: check tile size in decode_mb_info().
Michael Niedermayer
git at videolan.org
Sun Apr 15 15:17:03 CEST 2012
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Apr 15 14:11:50 2012 +0200| [5ad7335ebac2b38bb2a1c8df51a500b78461c05a] | committer: Michael Niedermayer
indeo5: check tile size in decode_mb_info().
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5ad7335ebac2b38bb2a1c8df51a500b78461c05a
---
libavcodec/indeo5.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c
index 50f4dd0..d0aea84 100644
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -468,6 +468,12 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv))
return AVERROR_INVALIDDATA;
+ if( tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size) ){
+ av_log(avctx, AV_LOG_ERROR, "allocated tile size %d mismatches parameters %d\n",
+ tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+ return AVERROR_INVALIDDATA;
+ }
+
/* scale factor for motion vectors */
mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
mv_x = mv_y = 0;
More information about the ffmpeg-cvslog
mailing list