Commit aa0dd524 authored by Martin Storsjö's avatar Martin Storsjö

xxan: Disallow odd width

Decoded data is always written in pairs within this decoder.
This fixes writes out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: 's avatarMartin Storsjö <martin@martin.st>
parent fc739b3e
...@@ -50,6 +50,10 @@ static av_cold int xan_decode_init(AVCodecContext *avctx) ...@@ -50,6 +50,10 @@ static av_cold int xan_decode_init(AVCodecContext *avctx)
av_log(avctx, AV_LOG_ERROR, "Invalid frame height: %d.\n", avctx->height); av_log(avctx, AV_LOG_ERROR, "Invalid frame height: %d.\n", avctx->height);
return AVERROR(EINVAL); return AVERROR(EINVAL);
} }
if (avctx->width & 1) {
av_log(avctx, AV_LOG_ERROR, "Invalid frame width: %d.\n", avctx->width);
return AVERROR(EINVAL);
}
s->buffer_size = avctx->width * avctx->height; s->buffer_size = avctx->width * avctx->height;
s->y_buffer = av_malloc(s->buffer_size); s->y_buffer = av_malloc(s->buffer_size);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment