1. ffmpeg
  2. Commit 286930d302fd34cfc2541bfdd760a8bbf9f2d2e5
Browse code

gifdec: check that w,h is not zero

Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2013/01/25 08:03:59
Showing 1 changed files
libavcodec/gifdec.c
History View file @ 286930d
... ... 
@@ -187,6 +187,8 @@ static int gif_read_image(GifState *s)
187 187 
     if (left + width > s->screen_width ||
188 188 
         top + height > s->screen_height)
189 189 
         return AVERROR_INVALIDDATA;
190 
+    if (width <= 0 || height <= 0)
191 
+        return AVERROR_INVALIDDATA;
190 192
191 193 
     /* process disposal method */
192 194 
     if (s->gce_prev_disposal == GCE_DISPOSAL_BACKGROUND) {