diff vp3.c @ 2422:18b8b2dcc037 libavcodec

various security fixes and precautionary checks

--- a/vp3.c	Tue Jan 11 08:16:04 2005 +0000
+++ b/vp3.c	Wed Jan 12 00:16:25 2005 +0000
@@ -2093,6 +2093,9 @@
         upper_motion_limit = 7 * s->current_frame.linesize[2];
         lower_motion_limit = height * s->current_frame.linesize[2] + width - 8;
     }
+    
+    if((unsigned)stride > 2048)
+        return; //various tables are fixed size
 
     /* for each fragment row... */
     for (y = 0; y < height; y += 8) {
@@ -2681,6 +2684,11 @@
     s->width = get_bits(&gb, 16) << 4;
     s->height = get_bits(&gb, 16) << 4;
     
+    if(avcodec_check_dimensions(avctx, s->width, s->height)){
+        s->width= s->height= 0;
+        return -1;
+    }
+    
     skip_bits(&gb, 24); /* frame width */
     skip_bits(&gb, 24); /* frame height */