vc1dec: odd sized sprites are unsupported
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 5 Mar 2013 23:03:58 +0000 (00:03 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 5 Mar 2013 23:09:54 +0000 (00:09 +0100)
It should be easy to add support but without a sample we would
not know if they work.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vc1dec.c

index 585918c..ff04508 100644 (file)
@@ -5292,6 +5292,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
             v->sprite_height > 1 << 14 ||
             v->output_width  > 1 << 14 ||
             v->output_height > 1 << 14) return -1;
+
+        if ((v->sprite_width&1) || (v->sprite_height&1)) {
+            av_log(avctx, AV_LOG_ERROR, "odd sprite\n");
+            return AVERROR_PATCHWELCOME;
+        }
     }
     return 0;
 }