diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2005-01-12 00:16:25 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2005-01-12 00:16:25 +0000 |
| commit | 0ecca7a49f8e254c12a3a1de048d738bfbb614c6 (patch) | |
| tree | 816c7073739d918ca579171204e6d3caf9977da5 /libavcodec/asv1.c | |
| parent | f14d4e7e21c48967c1a877fa9c4eb9943d2c30f5 (diff) | |
various security fixes and precautionary checks
Originally committed as revision 3822 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/asv1.c')
| -rw-r--r-- | libavcodec/asv1.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/asv1.c b/libavcodec/asv1.c index c369c0ea2a..1a6b4a82d4 100644 --- a/libavcodec/asv1.c +++ b/libavcodec/asv1.c @@ -339,8 +339,13 @@ static inline int decode_mb(ASV1Context *a, DCTELEM block[6][64]){ return 0; } -static inline void encode_mb(ASV1Context *a, DCTELEM block[6][64]){ +static inline int encode_mb(ASV1Context *a, DCTELEM block[6][64]){ int i; + + if(a->pb.buf_end - a->pb.buf - (put_bits_count(&a->pb)>>3) < 30*16*16*3/2/8){ + av_log(a->avctx, AV_LOG_ERROR, "encoded frame too large\n"); + return -1; + } if(a->avctx->codec_id == CODEC_ID_ASV1){ for(i=0; i<6; i++) @@ -349,6 +354,7 @@ static inline void encode_mb(ASV1Context *a, DCTELEM block[6][64]){ for(i=0; i<6; i++) asv2_encode_block(a, block[i]); } + return 0; } static inline void idct_put(ASV1Context *a, int mb_x, int mb_y){ |