[FFmpeg-cvslog] rv34: error out on size changes with frame threading

[Janne Grunau]

ffmpeg | branch: release/0.8 | Janne Grunau <janne-libav at jannau.net> | Fri Mar 23 22:30:38 2012 +0100| [801eff785aa1c791d75afaa59233e9b5e9e0f4c7] | committer: Reinhard Tartler

rv34: error out on size changes with frame threading

(cherry picked from commit cb7190cd2c691fd93e4d3664f3fce6c19ee001dd)

Fixes: CVE-2012-2772 (according to Ubuntu)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=801eff785aa1c791d75afaa59233e9b5e9e0f4c7
---

 libavcodec/rv34.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index a20a989..95ad5dd 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1280,6 +1280,14 @@ static int rv34_decode_slice(RV34DecContext *r, int end, const uint8_t* buf, int
 
     if ((s->mb_x == 0 && s->mb_y == 0) || s->current_picture_ptr==NULL) {
         if(s->width != r->si.width || s->height != r->si.height){
+
+            if (HAVE_THREADS &&
+                (s->avctx->active_thread_type & FF_THREAD_FRAME)) {
+                av_log_missing_feature(s->avctx, "Width/height changing with "
+                                       "frame threading is", 0);
+                return AVERROR_PATCHWELCOME;
+            }
+
             av_log(s->avctx, AV_LOG_DEBUG, "Changing dimensions to %dx%d\n", r->si.width,r->si.height);
             MPV_common_end(s);
             s->width  = r->si.width;