From 058e1f8dd71b30e3181a36cc66c5a278ebf835ba Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 6 Mar 2013 00:03:58 +0100 Subject: [PATCH] vc1dec: odd sized sprites are unsupported It should be easy to add support but without a sample we would not know if they work. Fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/vc1dec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 585918cd7b..ff04508b84 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5292,6 +5292,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx) v->sprite_height > 1 << 14 || v->output_width > 1 << 14 || v->output_height > 1 << 14) return -1; + + if ((v->sprite_width&1) || (v->sprite_height&1)) { + av_log(avctx, AV_LOG_ERROR, "odd sprite\n"); + return AVERROR_PATCHWELCOME; + } } return 0; }