avcodec: Extend the check for impossible dimensions
authorLuca Barbato <lu_zero@gentoo.org>
Sat, 26 Apr 2014 19:58:10 +0000 (21:58 +0200)
committerJean-Baptiste Kempf <jb@videolan.org>
Sun, 27 Apr 2014 14:46:14 +0000 (16:46 +0200)
Overly large frame sizes are commonly caused by broken streams.

Close #11245

Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
modules/codec/avcodec/video.c

index 022dee1..2e119d0 100644 (file)
@@ -136,9 +136,12 @@ static inline picture_t *ffmpeg_NewPictBuf( decoder_t *p_dec,
         avcodec_align_dimensions2(p_context, &width, &height, aligns);
     }
 
-    if( width == 0 || height == 0)
-        return NULL; /* invalid display size */
 
+    if( width == 0 || height == 0 || width > 8192 || height > 8192 )
+    {
+        msg_Err( p_dec, "Invalid frame size %dx%d.", width, height );
+        return NULL; /* invalid display size */
+    }
     p_dec->fmt_out.video.i_width = width;
     p_dec->fmt_out.video.i_height = height;