avcodec/webp: Check for VP8X after other VP8 chunks

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff --git a/libavcodec/webp.c b/libavcodec/webp.c
index d21536a..a4fd295 100644 (file)
--- a/libavcodec/webp.c
+++ b/libavcodec/webp.c
@@ -1423,6 +1423,10 @@ static int webp_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             bytestream2_skip(&gb, chunk_size);
             break;
         case MKTAG('V', 'P', '8', 'X'):
+            if (s->width || s->height || *got_frame) {
+                av_log(avctx, AV_LOG_ERROR, "Canvas dimensions are already set\n");
+                return AVERROR_INVALIDDATA;
+            }
             vp8x_flags = bytestream2_get_byte(&gb);
             bytestream2_skip(&gb, 3);
             s->width  = bytestream2_get_le24(&gb) + 1;