Commit 94b42da6 authored by Michael Niedermayer's avatar Michael Niedermayer

xldec: Check that width is a multiple of 4

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 80d51680
...@@ -52,6 +52,11 @@ static int decode_frame(AVCodecContext *avctx, ...@@ -52,6 +52,11 @@ static int decode_frame(AVCodecContext *avctx,
uint32_t val; uint32_t val;
int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0; int y0, y1, y2, y3 = 0, c0 = 0, c1 = 0;
if (avctx->width & 3) {
av_log(avctx, AV_LOG_ERROR, "width is not a multiple of 4\n");
return AVERROR_INVALIDDATA;
}
if(p->data[0]) if(p->data[0])
avctx->release_buffer(avctx, p); avctx->release_buffer(avctx, p);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment