Originally committed as revision 25861 to svn://svn.ffmpeg.org/ffmpeg/trunk
Unified · Split
| @@ -71,6 +71,8 @@ int av_image_fill_linesizes(int linesizes[4], enum PixelFormat pix_fmt, int widt · 70 unmodified lines | ||
| 71 | 71 | return AVERROR(EINVAL); |
| 72 | 72 | |
| 73 | 73 | if (desc->flags & PIX_FMT_BITSTREAM) { |
| 74 | + if (width > (INT_MAX -7) / (desc->comp[0].step_minus1+1)) | |
| 75 | + return AVERROR(EINVAL); | |
| 74 | 76 | linesizes[0] = (width * (desc->comp[0].step_minus1+1) + 7) >> 3; |
| 75 | 77 | return 0; |
| 76 | 78 | } |
| @@ -78,7 +80,10 @@ int av_image_fill_linesizes(int linesizes[4], enum PixelFormat pix_fmt, int widt · 1 unmodified line | ||
| 78 | 80 | av_image_fill_max_pixsteps(max_step, max_step_comp, desc); |
| 79 | 81 | for (i = 0; i < 4; i++) { |
| 80 | 82 | int s = (max_step_comp[i] == 1 || max_step_comp[i] == 2) ? desc->log2_chroma_w : 0; |
| 81 | − linesizes[i] = max_step[i] * (((width + (1 << s) - 1)) >> s); | |
| 83 | + int shifted_w = ((width + (1 << s) - 1)) >> s; | |
| 84 | + if (max_step[i] > INT_MAX / shifted_w) | |
| 85 | + return AVERROR(EINVAL); | |
| 86 | + linesizes[i] = max_step[i] * shifted_w; | |
| 82 | 87 | } |
| 83 | 88 | |
| 84 | 89 | return 0; |
| @@ -98,6 +103,8 @@ int av_image_fill_pointers(uint8_t *data[4], enum PixelFormat pix_fmt, int heigh · 13 unmodified lines | ||
| 98 | 103 | return AVERROR(EINVAL); |
| 99 | 104 | |
| 100 | 105 | data[0] = ptr; |
| 106 | + if (linesizes[0] > (INT_MAX - 1024) / height) | |
| 107 | + return AVERROR(EINVAL); | |
| 101 | 108 | size[0] = linesizes[0] * height; |
| 102 | 109 | |
| 103 | 110 | if (desc->flags & PIX_FMT_PAL) { |
| @@ -114,7 +121,11 @@ int av_image_fill_pointers(uint8_t *data[4], enum PixelFormat pix_fmt, int heigh · 10 unmodified lines | ||
| 114 | 121 | int h, s = (i == 1 || i == 2) ? desc->log2_chroma_h : 0; |
| 115 | 122 | data[i] = data[i-1] + size[i-1]; |
| 116 | 123 | h = (height + (1 << s) - 1) >> s; |
| 124 | + if (linesizes[i] > INT_MAX / h) | |
| 125 | + return AVERROR(EINVAL); | |
| 117 | 126 | size[i] = h * linesizes[i]; |
| 127 | + if (total_size > INT_MAX - size[i]) | |
| 128 | + return AVERROR(EINVAL); | |
| 118 | 129 | total_size += size[i]; |
| 119 | 130 | } |
| 120 | 131 | |