Fixes out of array read
Fixes: c50c4aa6cefda71b19a31ea12302980c/asan_heap-oob_12be5fd_7011_33ebd015a74976215934add72b9c8352.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9caa9414ccf2dcf8aee2695377dee830a5024c82)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
... | ... |
@@ -108,7 +108,7 @@ static int dxtory_decode_v1_420(AVCodecContext *avctx, AVFrame *pic, |
108 | 108 |
uint8_t *Y1, *Y2, *U, *V; |
109 | 109 |
int ret; |
110 | 110 |
|
111 |
- if (src_size < avctx->width * avctx->height * 3LL / 2) { |
|
111 |
+ if (src_size < FFALIGN(avctx->width, 2) * FFALIGN(avctx->height, 2) * 3LL / 2) { |
|
112 | 112 |
av_log(avctx, AV_LOG_ERROR, "packet too small\n"); |
113 | 113 |
return AVERROR_INVALIDDATA; |
114 | 114 |
} |