1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
Description: Validate image size in demux_gif
Fixes crash with -vo null and overflow.gif
Reported by Gustavo Grieco
Origin: upstream, commit:37857
Bug-Debian: https://bugs.debian.org/823723
--- a/libmpdemux/demux_gif.c
+++ b/libmpdemux/demux_gif.c
@@ -316,6 +316,17 @@
return NULL;
}
+ // Validate image size, most code in this demuxer assumes w*h <= INT_MAX
+ if ((int64_t)gif->SWidth * gif->SHeight > INT_MAX) {
+ mp_msg(MSGT_DEMUX, MSGL_ERR,
+ "[demux_gif] Unsupported picture size %dx%d.\n", gif->SWidth,
+ gif->SHeight);
+ if (DGifCloseFile(gif) == GIF_ERROR)
+ print_gif_error(NULL);
+ free(priv);
+ return NULL;
+ }
+
// create a new video stream header
sh_video = new_sh_video(demuxer, 0);
|
