shithub: libvpx

Info  •  Files  •  Log  •  Branches

Trap reference frames of invalid size

A corrupt bitstream could refer to a reference frame that has no size.

Change-Id: I56c3b71a9dbb58b498e9969403e289c0e574f948

--- a/vp9/decoder/vp9_decodframe.c

+++ b/vp9/decoder/vp9_decodframe.c

@@ -807,6 +807,10 @@

   if (!found)

     read_frame_size(cm, rb, &width, &height);

+  if (!width || !height)

+    vpx_internal_error(&cm->error, VPX_CODEC_CORRUPT_FRAME,

+                       "Referenced frame with invalid size");

+

   setup_display_size(pbi, rb);

   apply_frame_size(pbi, width, height);

 }