The HNM 4 video decoder's init function claimed that an allocation
failed if the image dimensions are wrong. This is fixed in this commit:
The dimensions are checked before the allocations are attempted.
The check whether width * height is zero is redundant as
av_image_check_size() already checks for this; it has been removed.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@gmail.com>
---
libavcodec/hnm4video.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c
index ac080e398b..173691a1eb 100644
--- a/libavcodec/hnm4video.c
+++ b/libavcodec/hnm4video.c
@@ -473,6 +473,8 @@ static av_cold int hnm_decode_init(AVCodecContext *avctx)
ret = av_image_check_size(avctx->width, avctx->height, 0, avctx);
if (ret < 0)
return ret;
+ if (avctx->height & 1)
+ return AVERROR(EINVAL);
hnm->version = avctx->extradata[0];
avctx->pix_fmt = AV_PIX_FMT_PAL8;
@@ -482,9 +484,7 @@ static av_cold int hnm_decode_init(AVCodecContext *avctx)
hnm->buffer2 = av_mallocz(avctx->width * avctx->height);
hnm->processed = av_mallocz(avctx->width * avctx->height);
- if ( !hnm->buffer1 || !hnm->buffer2 || !hnm->processed
- || avctx->width * avctx->height == 0
- || avctx->height % 2) {
+ if (!hnm->buffer1 || !hnm->buffer2 || !hnm->processed) {
av_log(avctx, AV_LOG_ERROR, "av_mallocz() failed\n");
return AVERROR(ENOMEM);
}
--
2.25.1
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
