1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00

vp7: bound checking in vp7_decode_frame_header

CC: libav-stable@libav.org
This commit is contained in:
Federico Tomassetti 2015-08-13 15:35:53 +02:00 committed by Luca Barbato
parent f34b152eb7
commit 7bf9647264

View File

@ -480,6 +480,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
int width = s->avctx->width;
int height = s->avctx->height;
if (buf_size < 4) {
return AVERROR_INVALIDDATA;
}
s->profile = (buf[0] >> 1) & 7;
if (s->profile > 1) {
avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);
@ -493,6 +497,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
buf += 4 - s->profile;
buf_size -= 4 - s->profile;
if (buf_size < part1_size) {
return AVERROR_INVALIDDATA;
}
memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, sizeof(s->put_pixels_tab));
ff_vp56_init_range_decoder(c, buf, part1_size);