[vlc-commits] codec: avcodec: fix broken check before copy (fix #22240)

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon May 20 14:27:39 2019 +0200| [603ecaf0f3fdf3b0a83cd2c773e05ac347b2149a] | committer: Francois Cartegnie

codec: avcodec: fix broken check before copy (fix #22240)

copy parameters are the picture ones

regression by c988b8d58b01ef6d628e3051774a2032dd7f6b7d

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=603ecaf0f3fdf3b0a83cd2c773e05ac347b2149a
---

 modules/codec/avcodec/video.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/codec/avcodec/video.c b/modules/codec/avcodec/video.c
index cccc84d22f..4f4d74fb6f 100644
--- a/modules/codec/avcodec/video.c
+++ b/modules/codec/avcodec/video.c
@@ -415,8 +415,9 @@ static int lavc_CopyPicture(decoder_t *dec, picture_t *pic, AVFrame *frame)
                 sys->p_context->pix_fmt, (name != NULL) ? name : "unknown");
         return VLC_EGENERIC;
     } else if (!chroma_compatible(fourcc, pic->format.i_chroma)
-     || frame->width > (int) pic->format.i_width
-     || frame->height > (int) pic->format.i_height)
+     /* ensure we never read more than dst lines/pixels from src */
+     || frame->width != (int) pic->format.i_visible_width
+     || frame->height < (int) pic->format.i_visible_height)
     {
         msg_Warn(dec, "dropping frame because the vout changed");
         return VLC_EGENERIC;