mss2: only use error correction for matching block counts
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 24 Nov 2016 22:57:46 +0000 (23:57 +0100)
committerLuca Barbato <lu_zero@gentoo.org>
Tue, 29 Nov 2016 09:38:01 +0000 (10:38 +0100)
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/mss2.c

index 355bb32..6fcadb1 100644 (file)
@@ -416,7 +416,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size,
 
     ff_vc1_decode_blocks(v);
 
 
     ff_vc1_decode_blocks(v);
 
-    ff_er_frame_end(&s->er);
+    if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) {
+        ff_er_frame_end(&s->er);
+    } else {
+        av_log(v->s.avctx, AV_LOG_WARNING,
+               "disabling error correction due to block count mismatch %dx%d != %dx%d\n",
+               v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height);
+    }
 
     ff_mpv_frame_end(s);
 
 
     ff_mpv_frame_end(s);