Module: libav Branch: release/12 Commit: 502ea393b1ca17e250783f41144e1448c4bb9ea3
Author: Andreas Cadhalpun <[email protected]> Committer: Luca Barbato <[email protected]> Date: Thu Nov 24 23:57:46 2016 +0100 mss2: only use error correction for matching block counts This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2 with coded_width/coded_height larger than width/height. Signed-off-by: Andreas Cadhalpun <[email protected]> Signed-off-by: Luca Barbato <[email protected]> (cherry picked from commit 1762a39e09a3edc27d1ef7bc50070f496b893aa4) Signed-off-by: Luca Barbato <[email protected]> --- libavcodec/mss2.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index 866ce47..3768196 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -416,7 +416,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size, ff_vc1_decode_blocks(v); - ff_er_frame_end(&s->er); + if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) { + ff_er_frame_end(&s->er); + } else { + av_log(v->s.avctx, AV_LOG_WARNING, + "disabling error correction due to block count mismatch %dx%d != %dx%d\n", + v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height); + } ff_mpv_frame_end(s); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
