[FFmpeg-cvslog] avcodec/ffv1dec: Check chroma shift parameters

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer <michaelni at gmx.at> | Mon May  4 13:37:26 2015 +0200| [ec17706e5ca2b073a44f7c3832845b899a44ee8e] | committer: Michael Niedermayer

avcodec/ffv1dec: Check chroma shift parameters

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit d43cd6b08ed555c303478e3133717fbb2236be6e)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ec17706e5ca2b073a44f7c3832845b899a44ee8e
---

 libavcodec/ffv1dec.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index b8df7ef..c366791 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -546,6 +546,12 @@ static int read_extra_header(FFV1Context *f)
     f->num_h_slices               = 1 + get_symbol(c, state, 0);
     f->num_v_slices               = 1 + get_symbol(c, state, 0);
 
+    if (f->chroma_h_shift > 4U || f->chroma_v_shift > 4U) {
+        av_log(f->avctx, AV_LOG_ERROR, "chroma shift parameters %d %d are invalid\n",
+               f->chroma_h_shift, f->chroma_v_shift);
+        return AVERROR_INVALIDDATA;
+    }
+
     if (f->num_h_slices > (unsigned)f->width  || !f->num_h_slices ||
         f->num_v_slices > (unsigned)f->height || !f->num_v_slices
        ) {
@@ -651,6 +657,12 @@ static int read_header(FFV1Context *f)
             }
         }
 
+        if (chroma_h_shift > 4U || chroma_v_shift > 4U) {
+            av_log(f->avctx, AV_LOG_ERROR, "chroma shift parameters %d %d are invalid\n",
+                   chroma_h_shift, chroma_v_shift);
+            return AVERROR_INVALIDDATA;
+        }
+
         f->colorspace                 = colorspace;
         f->avctx->bits_per_raw_sample = bits_per_raw_sample;
         f->chroma_planes              = chroma_planes;