diff mbox

[FFmpeg-devel] seqvideo_decode_init:check frame dimensions

Message ID SIXPR01MB0560E4E71DB182ACCFDAFD1AAD780@SIXPR01MB0560.apcprd01.prod.exchangelabs.com
State New
Headers show

Commit Message

Xiao Yang June 11, 2018, 7:07 a.m. UTC 
---
 libavcodec/tiertexseqv.c |    7 +++++++
 1 file changed, 7 insertions(+)

Comments

Michael Niedermayer June 12, 2018, 9:46 p.m. UTC | #1 
On Mon, Jun 11, 2018 at 07:07:36AM +0000, Xiao Yang wrote:
> ---
>  libavcodec/tiertexseqv.c |    7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/libavcodec/tiertexseqv.c b/libavcodec/tiertexseqv.c
> index af39f74..2d0fa98 100644
> --- a/libavcodec/tiertexseqv.c
> +++ b/libavcodec/tiertexseqv.c
> @@ -222,6 +222,13 @@ static av_cold int seqvideo_decode_init(AVCodecContext *avctx)
>      if (ret < 0)
>          return ret;
>  
> +    if (!avctx->width || !avctx->height ||
> +        (avctx->width & 1) || (avctx->height & 1)) {
> +        av_log(avctx, AV_LOG_ERROR, "Invalid video dimensions: %dx%d\n",
> +               avctx->width, avctx->height);
> +        return AVERROR(EINVAL);
> +    }

this makes no sense, 4 lines above the width and height is hardcoded to
256 x 128, this is neither 0 nor odd


[...]
diff mbox

Patch

diff --git a/libavcodec/tiertexseqv.c b/libavcodec/tiertexseqv.c
index af39f74..2d0fa98 100644
--- a/libavcodec/tiertexseqv.c
+++ b/libavcodec/tiertexseqv.c
@@ -222,6 +222,13 @@  static av_cold int seqvideo_decode_init(AVCodecContext *avctx)
     if (ret < 0)
         return ret;
 
+    if (!avctx->width || !avctx->height ||
+        (avctx->width & 1) || (avctx->height & 1)) {
+        av_log(avctx, AV_LOG_ERROR, "Invalid video dimensions: %dx%d\n",
+               avctx->width, avctx->height);
+        return AVERROR(EINVAL);
+    }
+
     seq->frame = av_frame_alloc();
     if (!seq->frame)
         return AVERROR(ENOMEM);