Originally committed as revision 25861 to svn://svn.ffmpeg.org/ffmpeg/trunk
Unified · Split
| @@ -71,6 +71,8 @@ int av_image_fill_linesizes(int linesizes[4], enum PixelFormat pix_fmt, int widt · 70 unmodified lines | |||
| 71 | return AVERROR(EINVAL); | 71 | return AVERROR(EINVAL); |
| 72 | 72 | ||
| 73 | if (desc->flags & PIX_FMT_BITSTREAM) { | 73 | if (desc->flags & PIX_FMT_BITSTREAM) { |
| 74 | if (width > (INT_MAX -7) / (desc->comp[0].step_minus1+1)) | ||
| 75 | return AVERROR(EINVAL); | ||
| 74 | linesizes[0] = (width * (desc->comp[0].step_minus1+1) + 7) >> 3; | 76 | linesizes[0] = (width * (desc->comp[0].step_minus1+1) + 7) >> 3; |
| 75 | return 0; | 77 | return 0; |
| 76 | } | 78 | } |
| @@ -78,7 +80,10 @@ int av_image_fill_linesizes(int linesizes[4], enum PixelFormat pix_fmt, int widt · 1 unmodified line | |||
| 78 | av_image_fill_max_pixsteps(max_step, max_step_comp, desc); | 80 | av_image_fill_max_pixsteps(max_step, max_step_comp, desc); |
| 79 | for (i = 0; i < 4; i++) { | 81 | for (i = 0; i < 4; i++) { |
| 80 | int s = (max_step_comp[i] == 1 || max_step_comp[i] == 2) ? desc->log2_chroma_w : 0; | 82 | int s = (max_step_comp[i] == 1 || max_step_comp[i] == 2) ? desc->log2_chroma_w : 0; |
| 81 | linesizes[i] = max_step[i] * (((width + (1 << s) - 1)) >> s); | 83 | int shifted_w = ((width + (1 << s) - 1)) >> s; |
| 84 | if (max_step[i] > INT_MAX / shifted_w) | ||
| 85 | return AVERROR(EINVAL); | ||
| 86 | linesizes[i] = max_step[i] * shifted_w; | ||
| 82 | } | 87 | } |
| 83 | 88 | ||
| 84 | return 0; | 89 | return 0; |
| @@ -98,6 +103,8 @@ int av_image_fill_pointers(uint8_t *data[4], enum PixelFormat pix_fmt, int heigh · 13 unmodified lines | |||
| 98 | return AVERROR(EINVAL); | 103 | return AVERROR(EINVAL); |
| 99 | 104 | ||
| 100 | data[0] = ptr; | 105 | data[0] = ptr; |
| 106 | if (linesizes[0] > (INT_MAX - 1024) / height) | ||
| 107 | return AVERROR(EINVAL); | ||
| 101 | size[0] = linesizes[0] * height; | 108 | size[0] = linesizes[0] * height; |
| 102 | 109 | ||
| 103 | if (desc->flags & PIX_FMT_PAL) { | 110 | if (desc->flags & PIX_FMT_PAL) { |
| @@ -114,7 +121,11 @@ int av_image_fill_pointers(uint8_t *data[4], enum PixelFormat pix_fmt, int heigh · 10 unmodified lines | |||
| 114 | int h, s = (i == 1 || i == 2) ? desc->log2_chroma_h : 0; | 121 | int h, s = (i == 1 || i == 2) ? desc->log2_chroma_h : 0; |
| 115 | data[i] = data[i-1] + size[i-1]; | 122 | data[i] = data[i-1] + size[i-1]; |
| 116 | h = (height + (1 << s) - 1) >> s; | 123 | h = (height + (1 << s) - 1) >> s; |
| 124 | if (linesizes[i] > INT_MAX / h) | ||
| 125 | return AVERROR(EINVAL); | ||
| 117 | size[i] = h * linesizes[i]; | 126 | size[i] = h * linesizes[i]; |
| 127 | if (total_size > INT_MAX - size[i]) | ||
| 128 | return AVERROR(EINVAL); | ||
| 118 | total_size += size[i]; | 129 | total_size += size[i]; |
| 119 | } | 130 | } |
| 120 | 131 | ||