diff options
| author | John Koleszar <jkoleszar@google.com> | 2013-06-11 14:24:53 -0700 |
|---|---|---|
| committer | Gerrit Code Review <gerrit@gerrit.golo.chromium.org> | 2013-06-11 15:16:38 -0700 |
| commit | 76e0c95dd93d6ecddb43969a3124e70d3a4c2dbc (patch) | |
| tree | e56920a3bb8808afbbebe2eaf7909ff20781c060 /vp9/decoder | |
| parent | 2bcc4736028e41862191916ffd711651d14519e1 (diff) | |
| download | libvpx-76e0c95dd93d6ecddb43969a3124e70d3a4c2dbc.tar libvpx-76e0c95dd93d6ecddb43969a3124e70d3a4c2dbc.tar.gz libvpx-76e0c95dd93d6ecddb43969a3124e70d3a4c2dbc.tar.bz2 libvpx-76e0c95dd93d6ecddb43969a3124e70d3a4c2dbc.zip | |
Trap reference frames of invalid size
A corrupt bitstream could refer to a reference frame that has no size.
Change-Id: I56c3b71a9dbb58b498e9969403e289c0e574f948
Diffstat (limited to 'vp9/decoder')
| -rw-r--r-- | vp9/decoder/vp9_decodframe.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/vp9/decoder/vp9_decodframe.c b/vp9/decoder/vp9_decodframe.c index f65d7c7cf..703aa0623 100644 --- a/vp9/decoder/vp9_decodframe.c +++ b/vp9/decoder/vp9_decodframe.c @@ -807,6 +807,10 @@ static void setup_frame_size_with_refs(VP9D_COMP *pbi, if (!found) read_frame_size(cm, rb, &width, &height); + if (!width || !height) + vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME, + "Referenced frame with invalid size"); + setup_display_size(pbi, rb); apply_frame_size(pbi, width, height); } |