indeo4/5: check empty tile size in decode_mb_info().
authorAnton Khirnov <anton@khirnov.net>
Sat, 29 Sep 2012 09:07:58 +0000 (11:07 +0200)
committerReinhard Tartler <siretart@tauware.de>
Sat, 2 Feb 2013 08:54:16 +0000 (09:54 +0100)
commit440e98574bde9ca606dfea60c7dda8de555067f7
treede8b96d1b602911c6e18274a14c90f8c9d5670be
parent604d72aa0d050a95aefdc15fc57743415af8283b
indeo4/5: check empty tile size in decode_mb_info().

This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2012-2800

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ae3da0ae5550053583a6f281ea7fd940497ea0d1)

Conflicts:

libavcodec/ivi_common.c
libavcodec/indeo5.c
libavcodec/ivi_common.c
libavcodec/ivi_common.h