wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 573405 - Check Theora frame sizes before initializing decoder. Also, check frame region size as well as picture region size. r=roc

Browse Source
This commit is contained in:
Matthew Gregan 2010-06-21 12:05:41 +12:00
parent b12a4e17ed
commit 9ce044175c
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
content/media/ogg/nsOggCodecState.cpp
View File

@ -166,10 +166,6 @@ nsTheoraState::~nsTheoraState() {
PRBool nsTheoraState::Init() { PRBool nsTheoraState::Init() {
if (!mActive) if (!mActive)
return PR_FALSE; return PR_FALSE;
mCtx = th_decode_alloc(&mInfo, mSetup);
if (mCtx == NULL) {
return mActive = PR_FALSE;
}
PRInt64 n = mInfo.fps_numerator; PRInt64 n = mInfo.fps_numerator;
PRInt64 d = mInfo.fps_denominator; PRInt64 d = mInfo.fps_denominator;
@ -190,8 +186,16 @@ PRBool nsTheoraState::Init() {
mPixelAspectRatio = (n == 0 || d == 0) ? mPixelAspectRatio = (n == 0 || d == 0) ?
1.0f : static_cast<float>(n) / static_cast<float>(d); 1.0f : static_cast<float>(n) / static_cast<float>(d);
// Ensure the frame isn't larger than our prescribed maximum. // Ensure the frame region isn't larger than our prescribed maximum.
PRUint32 pixels; PRUint32 pixels;
if (!MulOverflow32(mInfo.frame_width, mInfo.frame_height, pixels) ||
pixels > MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT ||
pixels == 0)
{
return mActive = PR_FALSE;
}
// Ensure the picture region isn't larger than our prescribed maximum.
if (!MulOverflow32(mInfo.pic_width, mInfo.pic_height, pixels) || if (!MulOverflow32(mInfo.pic_width, mInfo.pic_height, pixels) ||
pixels > MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT || pixels > MAX_VIDEO_WIDTH * MAX_VIDEO_HEIGHT ||
pixels == 0) pixels == 0)
@ -199,6 +203,11 @@ PRBool nsTheoraState::Init() {
return mActive = PR_FALSE; return mActive = PR_FALSE;
} }
mCtx = th_decode_alloc(&mInfo, mSetup);
if (mCtx == NULL) {
return mActive = PR_FALSE;
}
return PR_TRUE; return PR_TRUE;
} }