vc1dec: odd sized sprites are unsupported

It should be easy to add support but without a sample we would
not know if they work.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 585918cd7b42e700f3475e278627b5dfcb8df9d0..ff04508b8497d61a9933d06455dde6e72ba76da0 100644 (file)
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -5292,6 +5292,11 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
             v->sprite_height > 1 << 14 ||
             v->output_width  > 1 << 14 ||
             v->output_height > 1 << 14) return -1;
+
+        if ((v->sprite_width&1) || (v->sprite_height&1)) {
+            av_log(avctx, AV_LOG_ERROR, "odd sprite\n");
+            return AVERROR_PATCHWELCOME;
+        }
     }
     return 0;
 }