When dimensions differ from context, those were updated using ff_set_dimensions, however this overwrote the aligned coded_width and coded_height that were set before, leading to a buffer overflow when writing the frame data. Fixes: OssFuzz 438771336 Fixes: Heap-buffer-overflow
Unified · Split
| @@ -367,9 +367,6 @@ static int decode_frame(AVCodecContext *avctx, · 366 unmodified lines | |||
| 367 | if ((w & 1) || (h & 1)) | 367 | if ((w & 1) || (h & 1)) |
| 368 | return AVERROR_INVALIDDATA; | 368 | return AVERROR_INVALIDDATA; |
| 369 | 369 | ||
| 370 | avctx->coded_width = FFALIGN(w, 16); | ||
| 371 | avctx->coded_height = FFALIGN(h, 16); | ||
| 372 | |||
| 373 | if (w != avctx->width || h != avctx->height) { | 370 | if (w != avctx->width || h != avctx->height) { |
| 374 | av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n", | 371 | av_log(avctx, AV_LOG_WARNING, "picture resolution change: %ix%i -> %ix%i\n", |
| 375 | avctx->width, avctx->height, w, h); | 372 | avctx->width, avctx->height, w, h); |
| @@ -377,6 +374,9 @@ static int decode_frame(AVCodecContext *avctx, · 1 unmodified line | |||
| 377 | return ret; | 374 | return ret; |
| 378 | } | 375 | } |
| 379 | 376 | ||
| 377 | avctx->coded_width = FFALIGN(w, 16); | ||
| 378 | avctx->coded_height = FFALIGN(h, 16); | ||
| 379 | |||
| 380 | enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16; | 380 | enum AVPixelFormat pix_fmt = AV_PIX_FMT_BAYER_RGGB16; |
| 381 | if (pix_fmt != s->pix_fmt) { | 381 | if (pix_fmt != s->pix_fmt) { |
| 382 | s->pix_fmt = pix_fmt; | 382 | s->pix_fmt = pix_fmt; |