From 0a49a62f998747cfa564d98d36a459fe70d3299b Mon Sep 17 00:00:00 2001
From: Luca Barbato <lu_zero@gentoo.org>
Date: Fri, 26 Jun 2015 15:57:16 +0200
Subject: [PATCH] h263: Always check both dimensions
CC: libav-stable@libav.org
Found-By: ago@gentoo.org
---
libavcodec/ituh263dec.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c
index b1da22f6559..b9189b2e4d0 100644
--- a/libavcodec/ituh263dec.c
+++ b/libavcodec/ituh263dec.c
@@ -30,6 +30,7 @@
#include <limits.h>
#include "libavutil/attributes.h"
+#include "libavutil/imgutils.h"
#include "libavutil/internal.h"
#include "libavutil/mathematics.h"
#include "avcodec.h"
@@ -868,7 +869,7 @@ end:
/* most is hardcoded. should extend to handle all h263 streams */
int ff_h263_decode_picture_header(MpegEncContext *s)
{
- int format, width, height, i;
+ int format, width, height, i, ret;
uint32_t startcode;
align_get_bits(&s->gb);
@@ -919,8 +920,6 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
/* H.263v1 */
width = ff_h263_format[format][0];
height = ff_h263_format[format][1];
- if (!width)
- return -1;
s->pict_type = AV_PICTURE_TYPE_I + get_bits1(&s->gb);
@@ -1073,6 +1072,9 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
s->qscale = get_bits(&s->gb, 5);
}
+ if ((ret = av_image_check_size(s->width, s->height, 0, s)) < 0)
+ return ret;
+
s->mb_width = (s->width + 15) / 16;
s->mb_height = (s->height + 15) / 16;
s->mb_num = s->mb_width * s->mb_height;
--
GitLab