1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-19 05:49:09 +02:00

Make sure the block array is of the correct size.

This might have been exploitable.

backported r18393 by michael



Originally committed as revision 21758 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
This commit is contained in:
Reinhard Tartler 2010-02-11 20:57:49 +00:00
parent 9d442d2d7d
commit 48b98cdc67

View File

@ -1626,6 +1626,7 @@ static int alloc_blocks(SnowContext *s){
s->b_width = w;
s->b_height= h;
av_free(s->block);
s->block= av_mallocz(w * h * sizeof(BlockNode) << (s->block_max_depth*2));
return 0;
}
@ -4515,7 +4516,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, const
&& p->hcoeff[2]==2;
}
if(!s->block) alloc_blocks(s);
alloc_blocks(s);
frame_start(s);
//keyframe flag duplication mess FIXME