[SCM] libav/experimental: Check avctx width/height more thoroughly (e.g. all values 0 except width would have been accepted before). Also do not fail if they are invalid but instead override them to 0. This allows decoding e.g. MPEG video when only the container values are corrupted. For encoding a value of 0, 0 of course makes no sense, but was allowed through before and will be caught by an extra check in the encode function.

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 82eac2f3216534c065c5023e5599720bd17bed26
Author: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
Date:   Wed Sep 15 04:46:55 2010 +0000

    Check avctx width/height more thoroughly (e.g. all values 0 except width would
    have been accepted before).
    Also do not fail if they are invalid but instead override them to 0.
    This allows decoding e.g. MPEG video when only the container values are corrupted.
    For encoding a value of 0,0 of course makes no sense, but was allowed
    through before and will be caught by an extra check in the encode function.
    
    Originally committed as revision 25124 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index e12b677..543c1bd 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -485,10 +485,15 @@ int attribute_align_arg avcodec_open(AVCodecContext *avctx, AVCodec *codec)
     else if(avctx->width && avctx->height)
         avcodec_set_dimensions(avctx, avctx->width, avctx->height);
 
+    if ((avctx->coded_width || avctx->coded_height || avctx->width || avctx->height)
+        && (  av_image_check_size(avctx->coded_width, avctx->coded_height, 0, avctx) < 0
+           || av_image_check_size(avctx->width,       avctx->height,       0, avctx) < 0)) {
+        av_log(avctx, AV_LOG_WARNING, "ignoring invalid width/height values\n");
+        avcodec_set_dimensions(avctx, 0, 0);
+    }
+
 #define SANE_NB_CHANNELS 128U
-    if (((avctx->coded_width || avctx->coded_height)
-        && av_image_check_size(avctx->coded_width, avctx->coded_height, 0, avctx))
-        || avctx->channels > SANE_NB_CHANNELS) {
+    if (avctx->channels > SANE_NB_CHANNELS) {
         ret = AVERROR(EINVAL);
         goto free_and_end;
     }

-- 
Libav/FFmpeg packaging