Commit dc7f45a0 authored by Michael Niedermayer's avatar Michael Niedermayer

Make sure the block array is of the correct size.

This might have been exploitable.

Originally committed as revision 18393 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent bc4350a3
......@@ -1626,6 +1626,7 @@ static int alloc_blocks(SnowContext *s){
s->b_width = w;
s->b_height= h;
av_free(s->block);
s->block= av_mallocz(w * h * sizeof(BlockNode) << (s->block_max_depth*2));
return 0;
}
......@@ -4517,7 +4518,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
&& p->hcoeff[2]==2;
}
if(!s->block) alloc_blocks(s);
alloc_blocks(s);
frame_start(s);
//keyframe flag duplication mess FIXME
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment