avcodec/dvdsubdec: error on bitmaps with size 0
authorwm4 <nfxjfg@googlemail.com>
Wed, 7 Jan 2015 22:57:50 +0000 (23:57 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Jan 2015 16:18:41 +0000 (17:18 +0100)
Attemtping to decode them could lead to invalid writes with some fuzzed
samples.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcaa9099b3648b47060e1724a97dc98b63c83702)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dvdsubdec.c

index 5e22556..28027c2 100644 (file)
@@ -108,6 +108,9 @@ static int decode_rle(uint8_t *bitmap, int linesize, int w, int h,
     if (start >= buf_size)
         return -1;
 
+    if (w <= 0 || h <= 0)
+        return -1;
+
     bit_len = (buf_size - start) * 8;
     init_get_bits(&gb, buf + start, bit_len);