From: Michael Niedermayer <michaelni@gmx.at>
Date: Sat, 14 Apr 2012 18:04:05 +0000 (+0200)
Subject: indeo4: update AVCodecContext width/height on size change
X-Git-Tag: android-x86-4.4-r1~8529^2~456
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=b146d74730ab9ec5abede9066f770ad851e45fbc;p=android-x86%2Fexternal-ffmpeg.git

indeo4: update AVCodecContext width/height on size change

Fixes CVE-2012-2787

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index 5ebbf56d3c..6ff0f8028b 100644
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -780,6 +780,7 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
         avctx->release_buffer(avctx, &ctx->frame);
 
     ctx->frame.reference = 0;
+    avcodec_set_dimensions(avctx, ctx->planes[0].width, ctx->planes[0].height);
     if ((result = avctx->get_buffer(avctx, &ctx->frame)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return result;