Commit 1762a39e authored by Andreas Cadhalpun's avatar Andreas Cadhalpun Committed by Luca Barbato

mss2: only use error correction for matching block counts

This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: 's avatarLuca Barbato <lu_zero@gentoo.org>
parent d0c84c41
......@@ -416,7 +416,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size,
ff_vc1_decode_blocks(v);
if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) {
ff_er_frame_end(&s->er);
} else {
av_log(v->s.avctx, AV_LOG_WARNING,
"disabling error correction due to block count mismatch %dx%d != %dx%d\n",
v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height);
}
ff_mpv_frame_end(s);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment