diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-01 19:16:19 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-01 20:19:09 +0100 |
commit | 7389bb12e6b3ec3660592fde370d9dd4fe816d2b (patch) | |
tree | 304d5f37c219e882633df5f5d9f1c5d5cea48753 /libavcodec/svq1dec.c | |
parent | c9ff32215b433d505f251c1f212b1fa0a5e17b73 (diff) | |
download | ffmpeg-streaming-7389bb12e6b3ec3660592fde370d9dd4fe816d2b.zip ffmpeg-streaming-7389bb12e6b3ec3660592fde370d9dd4fe816d2b.tar.gz |
svq1dec: update w/h only if the header is successfully parsed.
Prevents inconsistency and out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/svq1dec.c')
-rw-r--r-- | libavcodec/svq1dec.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libavcodec/svq1dec.c b/libavcodec/svq1dec.c index e231eac..27e9606 100644 --- a/libavcodec/svq1dec.c +++ b/libavcodec/svq1dec.c @@ -505,6 +505,8 @@ static void svq1_parse_string(GetBitContext *bitbuf, uint8_t *out) static int svq1_decode_frame_header(GetBitContext *bitbuf, MpegEncContext *s) { int frame_size_code; + int width = s->width; + int height = s->height; skip_bits(bitbuf, 8); /* temporal_reference */ @@ -544,15 +546,15 @@ static int svq1_decode_frame_header(GetBitContext *bitbuf, MpegEncContext *s) if (frame_size_code == 7) { /* load width, height (12 bits each) */ - s->width = get_bits(bitbuf, 12); - s->height = get_bits(bitbuf, 12); + width = get_bits(bitbuf, 12); + height = get_bits(bitbuf, 12); - if (!s->width || !s->height) + if (!width || !height) return AVERROR_INVALIDDATA; } else { /* get width, height from table */ - s->width = ff_svq1_frame_size_table[frame_size_code].width; - s->height = ff_svq1_frame_size_table[frame_size_code].height; + width = ff_svq1_frame_size_table[frame_size_code].width; + height = ff_svq1_frame_size_table[frame_size_code].height; } } @@ -575,6 +577,8 @@ static int svq1_decode_frame_header(GetBitContext *bitbuf, MpegEncContext *s) skip_bits(bitbuf, 8); } + s->width = width; + s->height = height; return 0; } |