mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-09-20 21:36:48 +00:00
vc1: check that slices have a positive height
Fixes possible invalid reads. CC: libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
This commit is contained in:
parent
09b23786b3
commit
33f10546ec
@ -881,6 +881,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
|
|||||||
s->end_mb_y = (i == n_slices ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
|
s->end_mb_y = (i == n_slices ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
|
||||||
else
|
else
|
||||||
s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
|
s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
|
||||||
|
|
||||||
|
if (s->end_mb_y <= s->start_mb_y) {
|
||||||
|
av_log(v->s.avctx, AV_LOG_ERROR, "Invalid slice size\n");
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
ff_vc1_decode_blocks(v);
|
ff_vc1_decode_blocks(v);
|
||||||
if (i != n_slices)
|
if (i != n_slices)
|
||||||
s->gb = slices[i].gb;
|
s->gb = slices[i].gb;
|
||||||
|
Loading…
Reference in New Issue
Block a user