[FFmpeg-cvslog] ffmpeg: add image size check to codec_get_buffer()

Michael Niedermayer git at videolan.org
Wed Jan 25 06:52:04 CET 2012


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Jan 25 06:32:05 2012 +0100| [668494acd8b20f974c7722895d4a6a14c1005f1e] | committer: Michael Niedermayer

ffmpeg: add image size check to codec_get_buffer()

Fixes CVE-2011-3935

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=668494acd8b20f974c7722895d4a6a14c1005f1e
---

 ffmpeg.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/ffmpeg.c b/ffmpeg.c
index 0fe4186..dfdce6a 100644
--- a/ffmpeg.c
+++ b/ffmpeg.c
@@ -546,6 +546,9 @@ static int codec_get_buffer(AVCodecContext *s, AVFrame *frame)
     FrameBuffer *buf;
     int ret, i;
 
+    if(av_image_check_size(s->width, s->height, 0, s))
+        return -1;
+
     if (!ist->buffer_pool && (ret = alloc_buffer(s, ist, &ist->buffer_pool)) < 0)
         return ret;
 



More information about the ffmpeg-cvslog mailing list