Fix a crash that can happen due to corrupt mpeg2 data

The mpe2dec can return nonsense values for width and height that
make sws_getContext fail.  So check the context return value and
just drop the buffer if it fails.


git-svn-id: svn://svn.handbrake.fr/HandBrake/trunk@3963 b64f7644-9d1e-0410-96f1-a4d463321fa5

1 files changed, 9 insertions, 0 deletions

diff --git a/libhb/decmpeg2.c b/libhb/decmpeg2.c
index 2d2f41d41..81d5c360c 100644
--- a/libhb/decmpeg2.c
+++ b/libhb/decmpeg2.c
@@ -296,6 +296,12 @@ static hb_buffer_t *hb_copy_frame( hb_job_t *job, int width, int height,
     struct SwsContext *context = hb_sws_get_context( src_w, src_h, pixfmt,
                                                  dst_w, dst_h, PIX_FMT_YUV420P,
                                                  SWS_LANCZOS|SWS_ACCURATE_RND);
+    if ( context == NULL )
+    {
+        hb_buffer_close( &buf );
+        return NULL;
+    }
+
     sws_scale( context, (const uint8_t* const *)pic_crop.data, pic_crop.linesize, 0, src_h, out.data, out.linesize );
     sws_freeContext( context );
 
@@ -424,6 +430,9 @@ static int hb_libmpeg2_decode( hb_libmpeg2_t * m, hb_buffer_t * buf_es,
                                       m->info->display_fbuf->buf[0],
                                       m->info->display_fbuf->buf[1],
                                       m->info->display_fbuf->buf[2] );
+                if ( buf == NULL )
+                    continue;
+
                 buf->sequence = buf_es->sequence;
 
                 hb_buffer_t *cc_buf = NULL;