[FFmpeg-cvslog] rv34: error out on size changes with frame threading

[Janne Grunau]

ffmpeg | branch: release/0.10 | Janne Grunau <janne-libav at jannau.net> | Fri Mar 23 22:30:38 2012 +0100| [b1ad5a21da7ac56b853b6a21ed08a075ecbb89c6] | committer: Anton Khirnov

rv34: error out on size changes with frame threading

Fixes CVE-2012-2772

(cherry picked from commit cb7190cd2c691fd93e4d3664f3fce6c19ee001dd)

Signed-off-by: Anton Khirnov <anton at khirnov.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b1ad5a21da7ac56b853b6a21ed08a075ecbb89c6
---

 libavcodec/rv34.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 859ea50..c05b71b 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1677,6 +1677,13 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         if (s->width != si.width || s->height != si.height) {
             int err;
 
+            if (HAVE_THREADS &&
+                (s->avctx->active_thread_type & FF_THREAD_FRAME)) {
+                av_log_missing_feature(s->avctx, "Width/height changing with "
+                                       "frame threading is", 0);
+                return AVERROR_PATCHWELCOME;
+            }
+
             av_log(s->avctx, AV_LOG_WARNING, "Changing dimensions to %dx%d\n",
                    si.width, si.height);
             MPV_common_end(s);