Module: libav Branch: release/9 Commit: 43039f9386d2d81eb39a9737b1c622bb83af36f8
Author: Anton Khirnov <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Mon Apr 8 22:12:12 2013 +0200 svq1dec: check that the reference frame has the same dimensions as the current one They can be different if the last keyframe failed to decode correctly. Fixes possible invalid reads in such a case. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:[email protected] (cherry picked from commit b1bb8fb860b47e90dd67f0c5740698128fc82dcc) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/svq1dec.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index 5156042..19ff8d6 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -692,7 +692,8 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data, } else { /* delta frame */ uint8_t *previous = s->prev->data[i]; - if (!previous) { + if (!previous || + s->prev->width != s->width || s->prev->height != s->height) { av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); result = AVERROR_INVALIDDATA; goto err; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
