[vlc-devel] [PATCH] avcodec: Extend the check for impossible dimensions

[Jean-Baptiste Kempf]

On 26 Apr, Luca Barbato wrote :
> On 26/04/14 21:58, Luca Barbato wrote:
> > Overly large frame sizes are commonly caused by broken streams.
> > 
> > Bug-Id: 11245
> > ---
> > 
> > It isn't the perfect solution, sending in case you need it really quick.
> > 
> >  modules/codec/avcodec/video.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/modules/codec/avcodec/video.c b/modules/codec/avcodec/video.c
> > index 022dee1..15a3c44 100644
> > --- a/modules/codec/avcodec/video.c
> > +++ b/modules/codec/avcodec/video.c
> > @@ -136,9 +136,11 @@ static inline picture_t *ffmpeg_NewPictBuf( decoder_t *p_dec,
> >          avcodec_align_dimensions2(p_context, &width, &height, aligns);
> >      }
> > 
> > -    if( width == 0 || height == 0)
> > -        return NULL; /* invalid display size */
> > 
> > +    if( width == 0 || height == 0 || width > (1 << 14) || height > (1 << 14) ) {
> > +        msg_Err( p_dec, "Excessive frame size %dx%d.", width, height );
> > +        return NULL; /* invalid display size */
> > +    }
> >      p_dec->fmt_out.video.i_width = width;
> >      p_dec->fmt_out.video.i_height = height;
> 
> 
> Actually VoutValidateFormat rejects > 8192, locally amended to match.

LGTM. (careful about the "excessive part", since it can be 0 :) )

With my kindest regards,

-- 
Jean-Baptiste Kempf
http://www.jbkempf.com/ - +33 672 704 734
Sent from my Electronic Device