Module: libav Branch: release/0.7 Commit: 801eff785aa1c791d75afaa59233e9b5e9e0f4c7
Author: Janne Grunau <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Fri Mar 23 22:30:38 2012 +0100 rv34: error out on size changes with frame threading (cherry picked from commit cb7190cd2c691fd93e4d3664f3fce6c19ee001dd) Fixes: CVE-2012-2772 (according to Ubuntu) --- libavcodec/rv34.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index a20a989..95ad5dd 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1280,6 +1280,14 @@ static int rv34_decode_slice(RV34DecContext *r, int end, const uint8_t* buf, int if ((s->mb_x == 0 && s->mb_y == 0) || s->current_picture_ptr==NULL) { if(s->width != r->si.width || s->height != r->si.height){ + + if (HAVE_THREADS && + (s->avctx->active_thread_type & FF_THREAD_FRAME)) { + av_log_missing_feature(s->avctx, "Width/height changing with " + "frame threading is", 0); + return AVERROR_PATCHWELCOME; + } + av_log(s->avctx, AV_LOG_DEBUG, "Changing dimensions to %dx%d\n", r->si.width,r->si.height); MPV_common_end(s); s->width = r->si.width; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
