Mercurial > libavcodec.hg

changeset 4930:655d25351bfc libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix possibly exploitable stack overflow with num_sprite_warping_points (found by reimar)
author michael
date Sun, 06 May 2007 15:25:04 +0000
parents 67975429cb40
children 0d1cc37d9430
files h263.c
diffstat 1 files changed, 5 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/h263.c	Sun May 06 11:40:42 2007 +0000
+++ b/h263.c	Sun May 06 15:25:04 2007 +0000
@@ -5665,6 +5665,11 @@
                 skip_bits1(gb); /* marker */
             }
             s->num_sprite_warping_points= get_bits(gb, 6);
+            if(s->num_sprite_warping_points > 3){
+                av_log(s->avctx, AV_LOG_ERROR, "%d sprite_warping_points\n", s->num_sprite_warping_points);
+                s->num_sprite_warping_points= 0;
+                return -1;
+            }
             s->sprite_warping_accuracy = get_bits(gb, 2);
             s->sprite_brightness_change= get_bits1(gb);
             if(s->vol_sprite_usage==STATIC_SPRITE)