[FFmpeg-cvslog] vp8: fix crash due to skiped update_dimensions().

Michael Niedermayer git at videolan.org
Mon Apr 23 10:52:17 CEST 2012


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Apr 23 03:29:48 2012 +0200| [4d87001096ff1d4e3ee6f88f8caddbd8ccb2c816] | committer: Michael Niedermayer

vp8: fix crash due to skiped update_dimensions().

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4d87001096ff1d4e3ee6f88f8caddbd8ccb2c816
---

 libavcodec/vp8.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index 07e5b61..1ca5bab 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -108,7 +108,7 @@ static void vp8_decode_flush(AVCodecContext *avctx)
 
 static int update_dimensions(VP8Context *s, int width, int height)
 {
-    if (width  != s->avctx->width ||
+    if (width  != s->avctx->width || ((width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) && s->macroblocks_base ||
         height != s->avctx->height) {
         if (av_image_check_size(width, height, 0, s->avctx))
             return AVERROR_INVALIDDATA;
@@ -333,7 +333,7 @@ static int decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_size)
     }
 
     if (!s->macroblocks_base || /* first frame */
-        width != s->avctx->width || height != s->avctx->height) {
+        width != s->avctx->width || height != s->avctx->height || (width+15)/16 != s->mb_width || (height+15)/16 != s->mb_height) {
         if ((ret = update_dimensions(s, width, height)) < 0)
             return ret;
     }



More information about the ffmpeg-cvslog mailing list