@@ -790,6 +790,7 @@ static int decode_frame_header(AVCodecContext *avctx,
/* check reference frames */
if (!s->s.h.keyframe && !s->s.h.intraonly) {
+ int has_valid_ref_frame = 0;
for (i = 0; i < 3; i++) {
AVFrame *ref = s->s.refs[s->s.h.refidx[i]].f;
int refw = ref->width, refh = ref->height;
@@ -802,12 +803,15 @@ static int decode_frame_header(AVCodecContext *avctx,
return AVERROR_INVALIDDATA;
} else if (refw == w && refh == h) {
s->mvscale[i][0] = s->mvscale[i][1] = 0;
+ has_valid_ref_frame = 1;
} else {
- if (w * 2 < refw || h * 2 < refh || w > 16 * refw || h > 16 * refh) {
- av_log(avctx, AV_LOG_ERROR,
+ int is_ref_frame_invalid = (w * 2 < refw || h * 2 < refh || w > 16 * refw || h > 16 * refh);
+ if (is_ref_frame_invalid) {
+ av_log(avctx, AV_LOG_WARNING,
"Invalid ref frame dimensions %dx%d for frame size %dx%d\n",
refw, refh, w, h);
- return AVERROR_INVALIDDATA;
+ } else {
+ has_valid_ref_frame = 1;
}
s->mvscale[i][0] = (refw << 14) / w;
s->mvscale[i][1] = (refh << 14) / h;
@@ -815,6 +819,11 @@ static int decode_frame_header(AVCodecContext *avctx,
s->mvstep[i][1] = 16 * s->mvscale[i][1] >> 14;
}
}
+ if (!has_valid_ref_frame) {
+ av_log(avctx, AV_LOG_ERROR,
+ "Referenced frame has invalid size\n");
+ return AVERROR_INVALIDDATA;
+ }
}
if (s->s.h.keyframe || s->s.h.errorres || (s->s.h.intraonly && s->s.h.resetctx == 3)) {