diff options
Diffstat (limited to 'gst-libs/ext/libav/libavcodec/indeo3.c')
| -rw-r--r-- | gst-libs/ext/libav/libavcodec/indeo3.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/gst-libs/ext/libav/libavcodec/indeo3.c b/gst-libs/ext/libav/libavcodec/indeo3.c index 55b4ec7..294527e 100644 --- a/gst-libs/ext/libav/libavcodec/indeo3.c +++ b/gst-libs/ext/libav/libavcodec/indeo3.c @@ -416,6 +416,9 @@ static int decode_cell_data(Cell *cell, uint8_t *block, uint8_t *ref_block, blk_row_offset = (row_offset << (2 + v_zoom)) - (cell->width << 2); line_offset = v_zoom ? row_offset : 0; + if (cell->height & v_zoom || cell->width & h_zoom) + return IV3_BAD_DATA; + for (y = 0; y < cell->height; is_first_row = 0, y += 1 + v_zoom) { for (x = 0; x < cell->width; x += 1 + h_zoom) { ref = ref_block; @@ -895,6 +898,14 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx, av_dlog(avctx, "Frame dimensions changed!\n"); + if (width < 16 || width > 640 || + height < 16 || height > 480 || + width & 3 || height & 3) { + av_log(avctx, AV_LOG_ERROR, + "Invalid picture dimensions: %d x %d!\n", width, height); + return AVERROR_INVALIDDATA; + } + ctx->width = width; ctx->height = height; |