ffmpeg: add image size check to codec_get_buffer()
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 25 Jan 2012 05:32:05 +0000 (06:32 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 25 Jan 2012 05:48:30 +0000 (06:48 +0100)
Fixes CVE-2011-3935

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
ffmpeg.c

index 0fe4186..dfdce6a 100644 (file)
--- a/ffmpeg.c
+++ b/ffmpeg.c
@@ -546,6 +546,9 @@ static int codec_get_buffer(AVCodecContext *s, AVFrame *frame)
     FrameBuffer *buf;
     int ret, i;
 
+    if(av_image_check_size(s->width, s->height, 0, s))
+        return -1;
+
     if (!ist->buffer_pool && (ret = alloc_buffer(s, ist, &ist->buffer_pool)) < 0)
         return ret;