diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-07 23:42:35 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-08 00:28:35 +0100 |
| commit | 3b57bb478ff4455773378355e285877d757e151e (patch) | |
| tree | 06d214c4aad5cec08d24bbc0539aa55f4d46ff79 /libavcodec | |
| parent | dbf0a90572710976e3d8e77f76472465b84aba77 (diff) | |
svq1dec: check that the reference frame matches in size before using it.
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/svq1dec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index 187522c3bf..573568374a 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -692,7 +692,7 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data, } else { /* delta frame */ uint8_t *previous = s->prev->data[i]; - if (!previous) { + if (!previous || s->prev->width != s->cur->width || s->prev->height != s->cur->height) { av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\n"); result = AVERROR_INVALIDDATA; goto err; |