diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2014-05-05 20:39:30 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2014-05-05 20:47:24 +0400 |
commit | a69e16a97e40f3841766347bd0c0ba2c672c51ca (patch) | |
tree | f50321486082a9617c1df292531b63b4285ab440 | |
parent | 78d3453c4a2efef9bc079e8f3458653beafcf990 (diff) |
tests/tiny_ssim: check dimensions
Fix integer overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | tests/tiny_ssim.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/tests/tiny_ssim.c b/tests/tiny_ssim.c index fe65e47533..767a0fea06 100644 --- a/tests/tiny_ssim.c +++ b/tests/tiny_ssim.c @@ -29,6 +29,7 @@ #include "config.h" #include <inttypes.h> +#include <limits.h> #include <math.h> #include <stdio.h> #include <stdlib.h> @@ -195,7 +196,13 @@ int main(int argc, char* argv[]) f[0] = fopen(argv[1], "rb"); f[1] = fopen(argv[2], "rb"); sscanf(argv[3], "%dx%d", &w, &h); - frame_size = w*h*3/2; + + if (w<=0 || h<=0 || w*(int64_t)h >= INT_MAX/3 || 2LL*w+12 >= INT_MAX / sizeof(*temp)) { + fprintf(stderr, "Dimensions are too large\n"); + return -2; + } + + frame_size = w*h*3LL/2; for( i=0; i<2; i++ ) { buf[i] = malloc(frame_size); |