diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-07-14 15:48:17 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-15 11:29:59 +0200 |
| commit | 28dda8a691f1c723a4a9365ab85f9625f1330096 (patch) | |
| tree | a2f2cb8b7e1d71aacada978267db1a95fb718d70 /libavcodec/ivi_common.c | |
| parent | b0eeb9d442e4b7e82f6797d74245434ea33110a5 (diff) | |
indeo: Sanitize ff_ivi_init_planes fail paths
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/ivi_common.c')
| -rw-r--r-- | libavcodec/ivi_common.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index 1aa47fc6a3..6436cd3874 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -244,6 +244,7 @@ static av_cold void ivi_free_buffers(IVIPlaneDesc *planes) av_freep(&planes[p].bands[b].tiles); } av_freep(&planes[p].bands); + planes[p].num_bands = 0; } } @@ -256,6 +257,10 @@ av_cold int ff_ivi_init_planes(IVIPlaneDesc *planes, const IVIPicConfig *cfg) ivi_free_buffers(planes); + if (cfg->pic_width < 1 || cfg->pic_height < 1 || + cfg->luma_bands < 1 || cfg->chroma_bands < 1) + return AVERROR_INVALIDDATA; + /* fill in the descriptor of the luminance plane */ planes[0].width = cfg->pic_width; planes[0].height = cfg->pic_height; |