eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update dimensions in AVCodecContext when RV3/4 frame dimensions change

Browse Source 
Originally committed as revision 20572 to svn://svn.ffmpeg.org/ffmpeg/trunk
(cherry picked from commit ec10d2d539)

Fixes heap corruption crashes

Addresses: CVE-2011-0722
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Kostya Shishkov
2009-11-22 07:48:35 +00:00
committed by Reinhard Tartler
parent 48b086b0ef
commit 44511b17cb
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/rv34.c
+2 -2
View File
@@ -1247,8 +1247,8 @@ static int rv34_decode_slice(RV34DecContext *r, int end, const uint8_t* buf, int
if(s->width != r->si.width || s->height != r->si.height){
av_log(s->avctx, AV_LOG_DEBUG, "Changing dimensions to %dx%d\n", r->si.width,r->si.height);
MPV_common_end(s);
s->width = r->si.width;
s->height = r->si.height;
s->width = s->avctx->width = r->si.width;
s->height = s->avctx->height = r->si.height;
if(MPV_common_init(s) < 0)
return -1;
r->intra_types_hist = av_realloc(r->intra_types_hist, s->b4_stride * 4 * 2 * sizeof(*r->intra_types_hist));