From 70f0ffa1ed456fd0b560d0dd1d0d93f1ba3a6d93 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 14 Aug 2012 18:58:49 +0200 Subject: [PATCH] bmv_videodec: fix out of array read Fixes Ticket1373 Signed-off-by: Michael Niedermayer --- libavcodec/bmv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c index b2d42cc5d2..5d33b910c9 100644 --- a/libavcodec/bmv.c +++ b/libavcodec/bmv.c @@ -272,6 +272,11 @@ static av_cold int decode_init(AVCodecContext *avctx) c->avctx = avctx; avctx->pix_fmt = PIX_FMT_PAL8; + if (avctx->width != SCREEN_WIDE || avctx->height != SCREEN_HIGH) { + av_log(avctx, AV_LOG_ERROR, "Invalid dimension %dx%d\n", avctx->width, avctx->height); + return AVERROR_INVALIDDATA; + } + c->pic.reference = 1; if (avctx->get_buffer(avctx, &c->pic) < 0) { av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");