When dimensions differ from context, those were updated using ff_set_dimensions, however this overwrote the aligned coded_width and coded_height that were set before, leading to a buffer overflow when writing the frame data. Fixes: OssFuzz 438771336 Fixes: Heap-buffer-overflow
Unified · Split
| @@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx, · 366 unmodified lines | ||
| 367 | 367 | if ((w & 1) || (h & 1)) |
| 368 | 368 | return AVERROR_INVALIDDATA; |
| 369 | 369 | |
| 370 | − avctx->coded_width = FFALIGN(w, 16); | |
| 371 | − avctx->coded_height = FFALIGN(h, 16); | |
| 372 | − | |
| 373 | 370 | if (w != avctx->width || h != avctx->height) { |
| 374 | 371 | av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n", |
| 375 | 372 | avctx->width, avctx->height, w, h); |
| @@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx, · 1 unmodified line | ||
| 377 | 374 | return ret; |
| 378 | 375 | } |
| 379 | 376 | |
| 377 | + avctx->coded_width = FFALIGN(w, 16); | |
| 378 | + avctx->coded_height = FFALIGN(h, 16); | |
| 379 | + | |
| 380 | 380 | enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16; |
| 381 | 381 | if (pix_fmt != s->pix_fmt) { |
| 382 | 382 | s->pix_fmt = pix_fmt; |