avcodec/h264_slice: Fix container cropping
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 8 Jul 2015 15:49:00 +0000 (17:49 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 8 Jul 2015 15:50:05 +0000 (17:50 +0200)
Fixes out of array read
Fixes: asan_heap-oob_394322e_138_cov_4265020547_CVPCMNL1_SVA_C.264

Found-by: Samuel GroƟ, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h264_slice.c

index 4b6c217..10a50bb 100644 (file)
@@ -980,7 +980,10 @@ static int init_dimensions(H264Context *h)
 
     /* handle container cropping */
     if (FFALIGN(h->avctx->width,  16) == FFALIGN(width,  16) &&
-        FFALIGN(h->avctx->height, 16) == FFALIGN(height, 16)) {
+        FFALIGN(h->avctx->height, 16) == FFALIGN(height, 16) &&
+        h->avctx->width  <= width &&
+        h->avctx->height <= height
+    ) {
         width  = h->avctx->width;
         height = h->avctx->height;
     }