indeo3: validate new frame size before resetting decoder
authorKostya Shishkov <kostya.shishkov@gmail.com>
Mon, 14 May 2012 17:46:54 +0000 (19:46 +0200)
committerKostya Shishkov <kostya.shishkov@gmail.com>
Tue, 15 May 2012 17:05:39 +0000 (19:05 +0200)
libavcodec/indeo3.c

index e5b2ea7..d526d91 100644 (file)
@@ -900,6 +900,14 @@ static int decode_frame_headers(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
 
         av_dlog(avctx, "Frame dimensions changed!\n");
 
+        if (width  < 16 || width  > 640 ||
+            height < 16 || height > 480 ||
+            width  &  3 || height &   3) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "Invalid picture dimensions: %d x %d!\n", width, height);
+            return AVERROR_INVALIDDATA;
+        }
+
         ctx->width  = width;
         ctx->height = height;