From eebbb33abfe82bb3b044ff1f1cb0b263bde9402b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 9 Apr 2009 20:23:13 +0000 Subject: Make sure spatial_decomposition_count is not too large for picture size. this led to an infinite loop in mirror(). Originally committed as revision 18396 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/snow.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavcodec/snow.c') diff --git a/libavcodec/snow.c b/libavcodec/snow.c index ffdf1ffd02..ee0ae33a13 100644 --- a/libavcodec/snow.c +++ b/libavcodec/snow.c @@ -3625,6 +3625,11 @@ static int decode_header(SnowContext *s){ av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_type %d not supported", s->spatial_decomposition_type); return -1; } + if(FFMIN(s->avctx-> width>>s->chroma_h_shift, + s->avctx->height>>s->chroma_v_shift) >> (s->spatial_decomposition_count-1) <= 0){ + av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_count %d too large for size", s->spatial_decomposition_count); + return -1; + } s->qlog += get_symbol(&s->c, s->header_state, 1); s->mv_scale += get_symbol(&s->c, s->header_state, 1); -- cgit v1.2.3