Commit 3583c870 authored by Michael Niedermayer's avatar Michael Niedermayer

vqavideodev: Check image dimensions

Fixes out of heap array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 464cef4c
...@@ -164,6 +164,11 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx) ...@@ -164,6 +164,11 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
if (!s->next_codebook_buffer) if (!s->next_codebook_buffer)
goto fail; goto fail;
if (s->width % s->vector_width || s->height % s->vector_height) {
av_log(avctx, AV_LOG_ERROR, "Picture dimensions are not a multiple of the vector size\n");
goto fail;
}
/* allocate decode buffer */ /* allocate decode buffer */
s->decode_buffer_size = (s->width / s->vector_width) * s->decode_buffer_size = (s->width / s->vector_width) *
(s->height / s->vector_height) * 2; (s->height / s->vector_height) * 2;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment