# HG changeset patch
# User reimar
# Date 1396811947 0
# Node ID 2921fb48ffb99414d5538833169d51e6de0500d9
# Parent  ce9f83c645157c3c0fcd60041ce60f1ee622d2a5
vf_remove_logo: sanity-check PGM width/height.

diff -r ce9f83c64515 -r 2921fb48ffb9 libmpcodecs/vf_remove_logo.c
--- a/libmpcodecs/vf_remove_logo.c	Sun Apr 06 19:16:01 2014 +0000
+++ b/libmpcodecs/vf_remove_logo.c	Sun Apr 06 19:19:07 2014 +0000
@@ -553,6 +553,9 @@
   if (maximum_greyscale_value >= 256) REMOVE_LOGO_LOAD_PGM_ERROR_MESSAGE("[vf]remove_logo: Only 1 byte per pixel (pgm) or 1 byte per color value (ppm) are supported.\n");
   load_pgm_skip(input);
 
+  if (new_pgm->width <= 0 || new_pgm->width > 0x7fff ||
+      new_pgm->height <= 0 || new_pgm->height > 0x7fff)
+    REMOVE_LOGO_LOAD_PGM_ERROR_MESSAGE("[vf]remove_logo: Invalid PGM dimensions.\n");
   image_size = new_pgm->width * new_pgm->height;
   new_pgm->pixel = safe_malloc (image_size);