diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 01:22:31 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 01:43:12 +0100 |
| commit | b5f4836f8cb374f1a5ae45db48b61a1dfba0daad (patch) | |
| tree | d985e7e2aa42d607dc0568c8eeaaf8be7f69e45b | |
| parent | 8824a9ed2291d2b004dc641bd9ea8ad6f983466a (diff) | |
vc1: check image height, fix division by 0
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vc1dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 1e78f385f8..7c07138007 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5521,6 +5521,11 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } + if ((s->mb_height >> v->field_mode) == 0) { + av_log(v->s.avctx, AV_LOG_ERROR, "image too short\n"); + goto err; + } + // process pulldown flags s->current_picture_ptr->f.repeat_pict = 0; // Pulldown flags are only valid when 'broadcast' has been set. |