Mercurial > libavcodec.hg

comparison imgconvert.c @ 2422:18b8b2dcc037 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
various security fixes and precautionary checks
author michael
date Wed, 12 Jan 2005 00:16:25 +0000
parents 270666128b07
children c8d53188048d
comparison
equal deleted inserted replaced
2421:e326490f58c4 2422:18b8b2dcc037
266 int pix_fmt, int width, int height) 266 int pix_fmt, int width, int height)
267 { 267 {
268 int size, w2, h2, size2; 268 int size, w2, h2, size2;
269 PixFmtInfo *pinfo; 269 PixFmtInfo *pinfo;
270 270
271 if(avcodec_check_dimensions(NULL, width, height))
272 goto fail;
273
271 pinfo = &pix_fmt_info[pix_fmt]; 274 pinfo = &pix_fmt_info[pix_fmt];
272 size = width * height; 275 size = width * height;
273 switch(pix_fmt) { 276 switch(pix_fmt) {
274 case PIX_FMT_YUV420P: 277 case PIX_FMT_YUV420P:
275 case PIX_FMT_YUV422P: 278 case PIX_FMT_YUV422P:
342 picture->data[2] = NULL; 345 picture->data[2] = NULL;
343 picture->linesize[0] = width; 346 picture->linesize[0] = width;
344 picture->linesize[1] = 4; 347 picture->linesize[1] = 4;
345 return size2 + 256 * 4; 348 return size2 + 256 * 4;
346 default: 349 default:
350 fail:
347 picture->data[0] = NULL; 351 picture->data[0] = NULL;
348 picture->data[1] = NULL; 352 picture->data[1] = NULL;
349 picture->data[2] = NULL; 353 picture->data[2] = NULL;
350 picture->data[3] = NULL; 354 picture->data[3] = NULL;
351 return -1; 355 return -1;
358 PixFmtInfo* pf = &pix_fmt_info[pix_fmt]; 362 PixFmtInfo* pf = &pix_fmt_info[pix_fmt];
359 int i, j, w, h, data_planes; 363 int i, j, w, h, data_planes;
360 const unsigned char* s; 364 const unsigned char* s;
361 int size = avpicture_get_size(pix_fmt, width, height); 365 int size = avpicture_get_size(pix_fmt, width, height);
362 366
363 if (size > dest_size) 367 if (size > dest_size || size < 0)
364 return -1; 368 return -1;
365 369
366 if (pf->pixel_type == FF_PIXEL_PACKED || pf->pixel_type == FF_PIXEL_PALETTE) { 370 if (pf->pixel_type == FF_PIXEL_PACKED || pf->pixel_type == FF_PIXEL_PALETTE) {
367 if (pix_fmt == PIX_FMT_YUV422 || 371 if (pix_fmt == PIX_FMT_YUV422 ||
368 pix_fmt == PIX_FMT_UYVY422 || 372 pix_fmt == PIX_FMT_UYVY422 ||
1918 { 1922 {
1919 unsigned int size; 1923 unsigned int size;
1920 void *ptr; 1924 void *ptr;
1921 1925
1922 size = avpicture_get_size(pix_fmt, width, height); 1926 size = avpicture_get_size(pix_fmt, width, height);
1927 if(size<0)
1928 goto fail;
1923 ptr = av_malloc(size); 1929 ptr = av_malloc(size);
1924 if (!ptr) 1930 if (!ptr)
1925 goto fail; 1931 goto fail;
1926 avpicture_fill(picture, ptr, pix_fmt, width, height); 1932 avpicture_fill(picture, ptr, pix_fmt, width, height);
1927 return 0; 1933 return 0;