indeo5: check tile size in decode_mb_info().
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 15 Apr 2012 12:11:50 +0000 (14:11 +0200)
committerReinhard Tartler <siretart@tauware.de>
Fri, 4 Jan 2013 06:43:37 +0000 (07:43 +0100)
commitaa097b4d5fd41679cda6780fd8d70a3de33c6820
tree7bf7c1ba2e19bb73c3d0f9b2f8869c3021a689f7
parent8148833193c6773b3db9b1759e62c2295d487ec7
indeo5: check tile size in decode_mb_info().

This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Fixes CVE-2012-2794

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2d09cdbaf2f449ba23d54e97e94bd97ca22208c6)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavcodec/indeo5.c