diff options
| author | Peter Ross <pross@xvid.org> | 2012-11-26 22:45:07 +1100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2012-11-26 12:11:08 +0000 |
| commit | f2dc82b90ffe4191ea5f207e6b3ffc473e093f65 (patch) | |
| tree | cf9a3010e06a27aac57ddb29b10116784c0eb1dc /libavcodec/dpx.c | |
| parent | 5a3370816fc9549a742c7c458337bd9489804ac0 (diff) | |
dpx: perform width/height upgrade and av_image_check_size earlier to prevent segfault on malformed input
Signed-off-by: Peter Ross <pross@xvid.org>
Diffstat (limited to 'libavcodec/dpx.c')
| -rw-r--r-- | libavcodec/dpx.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c index bfc88b6d35..4d09efe543 100644 --- a/libavcodec/dpx.c +++ b/libavcodec/dpx.c @@ -104,6 +104,11 @@ static int decode_frame(AVCodecContext *avctx, buf = avpkt->data + 0x304; w = read32(&buf, endian); h = read32(&buf, endian); + if (av_image_check_size(w, h, 0, avctx)) + return AVERROR(EINVAL); + + if (w != avctx->width || h != avctx->height) + avcodec_set_dimensions(avctx, w, h); // Need to end in 0x320 to read the descriptor buf += 20; @@ -182,10 +187,6 @@ static int decode_frame(AVCodecContext *avctx, if (s->picture.data[0]) avctx->release_buffer(avctx, &s->picture); - if (av_image_check_size(w, h, 0, avctx)) - return -1; - if (w != avctx->width || h != avctx->height) - avcodec_set_dimensions(avctx, w, h); if (avctx->get_buffer(avctx, p) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); return -1; |