gifdec: check that w,h is not zero
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 24 Jan 2013 23:03:59 +0000 (00:03 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 25 Jan 2013 02:30:04 +0000 (03:30 +0100)
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/gifdec.c

index 2d9f8b4..d52f2d5 100644 (file)
@@ -187,6 +187,8 @@ static int gif_read_image(GifState *s)
     if (left + width > s->screen_width ||
         top + height > s->screen_height)
         return AVERROR_INVALIDDATA;
     if (left + width > s->screen_width ||
         top + height > s->screen_height)
         return AVERROR_INVALIDDATA;
+    if (width <= 0 || height <= 0)
+        return AVERROR_INVALIDDATA;
 
     /* process disposal method */
     if (s->gce_prev_disposal == GCE_DISPOSAL_BACKGROUND) {
 
     /* process disposal method */
     if (s->gce_prev_disposal == GCE_DISPOSAL_BACKGROUND) {