comparison vp3.c @ 2422:18b8b2dcc037 libavcodec

various security fixes and precautionary checks

2421:e326490f58c4

        stride = s->current_frame.linesize[2];
	if (!s->flipped_image) stride = -stride;
        upper_motion_limit = 7 * s->current_frame.linesize[2];
        lower_motion_limit = height * s->current_frame.linesize[2] + width - 8;
    }

    /* for each fragment row... */
    for (y = 0; y < height; y += 8) {

        /* for each fragment in a row... */

        av_log(avctx, AV_LOG_DEBUG, "Old (<alpha3) Theora bitstream, flipped image\n");
    }

    s->width = get_bits(&gb, 16) << 4;
    s->height = get_bits(&gb, 16) << 4;
    
    skip_bits(&gb, 24); /* frame width */
    skip_bits(&gb, 24); /* frame height */

    skip_bits(&gb, 8); /* offset x */

2422:18b8b2dcc037

        stride = s->current_frame.linesize[2];
	if (!s->flipped_image) stride = -stride;
        upper_motion_limit = 7 * s->current_frame.linesize[2];
        lower_motion_limit = height * s->current_frame.linesize[2] + width - 8;
    }
    
    if((unsigned)stride > 2048)
        return; //various tables are fixed size

    /* for each fragment row... */
    for (y = 0; y < height; y += 8) {

        /* for each fragment in a row... */

        av_log(avctx, AV_LOG_DEBUG, "Old (<alpha3) Theora bitstream, flipped image\n");
    }

    s->width = get_bits(&gb, 16) << 4;
    s->height = get_bits(&gb, 16) << 4;
    
    if(avcodec_check_dimensions(avctx, s->width, s->height)){
        s->width= s->height= 0;
        return -1;
    }
    
    skip_bits(&gb, 24); /* frame width */
    skip_bits(&gb, 24); /* frame height */

    skip_bits(&gb, 8); /* offset x */