# HG changeset patch # User bcoudurier # Date 1245018868 0 # Node ID 756ac43c7fd9a393660906d9ba93e5c0fed7ab0a # Parent 2428d32533f62a1af7c7382ec1903a812399d50b check if frame size matches old sys and assumes corrupted input, fixes #1192 diff -r 2428d32533f6 -r 756ac43c7fd9 dv.c --- a/dv.c Sun Jun 14 09:55:28 2009 +0000 +++ b/dv.c Sun Jun 14 22:34:28 2009 +0000 @@ -1119,7 +1119,7 @@ int buf_size = avpkt->size; DVVideoContext *s = avctx->priv_data; - s->sys = dv_frame_profile(buf); + s->sys = dv_frame_profile(s->sys, buf, buf_size); if (!s->sys || buf_size < s->sys->frame_size || dv_init_dynamic_tables(s->sys)) return -1; /* NOTE: we only accept several full frames */ diff -r 2428d32533f6 -r 756ac43c7fd9 dvdata.h --- a/dvdata.h Sun Jun 14 09:55:28 2009 +0000 +++ b/dvdata.h Sun Jun 14 22:34:28 2009 +0000 @@ -698,7 +698,9 @@ */ #define DV_MAX_BPM 8 -static inline const DVprofile* dv_frame_profile(const uint8_t* frame) +static inline +const DVprofile* dv_frame_profile(const DVprofile *sys, + const uint8_t* frame, unsigned buf_size) { int i; @@ -715,6 +717,10 @@ if (dsf == dv_profiles[i].dsf && stype == dv_profiles[i].video_stype) return &dv_profiles[i]; + /* check if old sys matches and assumes corrupted input */ + if (sys && buf_size == sys->frame_size) + return sys; + return NULL; }