mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-09-07 16:40:10 +02:00
sanm: check image dimensions before using them
Avoids integer overflows and out of array accesses. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
c4274d118b
commit
49b729d3af
@ -26,6 +26,7 @@
|
||||
#include "bytestream.h"
|
||||
#include "internal.h"
|
||||
#include "libavutil/bswap.h"
|
||||
#include "libavutil/imgutils.h"
|
||||
#include "libavcodec/dsputil.h"
|
||||
#include "sanm_data.h"
|
||||
|
||||
@ -716,8 +717,11 @@ static int process_frame_obj(SANMVideoContext *ctx)
|
||||
h = bytestream2_get_le16u(&ctx->gb);
|
||||
|
||||
if (ctx->width < left + w || ctx->height < top + h) {
|
||||
ctx->avctx->width = FFMAX(left + w, ctx->width);
|
||||
ctx->avctx->height = FFMAX(top + h, ctx->height);
|
||||
if (av_image_check_size(FFMAX(left + w, ctx->width),
|
||||
FFMAX(top + h, ctx->height), 0, ctx->avctx) < 0)
|
||||
return AVERROR_INVALIDDATA;
|
||||
avcodec_set_dimensions(ctx->avctx, FFMAX(left + w, ctx->width),
|
||||
FFMAX(top + h, ctx->height));
|
||||
init_sizes(ctx, left + w, top + h);
|
||||
if (init_buffers(ctx)) {
|
||||
av_log(ctx->avctx, AV_LOG_ERROR, "error resizing buffers\n");
|
||||
|
Loading…
Reference in New Issue
Block a user