Check VideoFrame::IsValidConfig() prior to allocating buffers for FFmpeg.

media/filters/ffmpeg_video_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/filters/ffmpeg_video_decoder.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 63 matching lines @@
   if (format == VideoFrame::INVALID)
     return AVERROR(EINVAL);
   DCHECK(format == VideoFrame::YV12 || format == VideoFrame::YV16);
 
   int width = codec_context->width;
   int height = codec_context->height;
   int ret;
   if ((ret = av_image_check_size(width, height, 0, NULL)) < 0)
     return ret;
 
+  if (!VideoFrame::IsValidConfig(format, width, height))
+    return AVERROR(EINVAL);
+
   scoped_refptr<VideoFrame> video_frame =
       VideoFrame::CreateFrame(format, width, height, kNoTimestamp());

[scherkus (not reviewing), 2012/08/06 20:42:34]

this DCHECKs for IsValidConfig() but in release mode we'll end up creating
invalid frames

 
   for (int i = 0; i < 3; i++) {
     frame->base[i] = video_frame->data(i);
     frame->data[i] = video_frame->data(i);
     frame->linesize[i] = video_frame->stride(i);
   }
 
   frame->opaque = video_frame.release();
   frame->type = FF_BUFFER_TYPE_USER;
   frame->pkt_pts = codec_context->pkt ? codec_context->pkt->pts :
@@ skipping 417 matching lines @@
     av_free(codec_context_);
     codec_context_ = NULL;
   }
   if (av_frame_) {
     av_free(av_frame_);
     av_frame_ = NULL;
   }
 }
 
 }  // namespace media