[shotwell] Better guards against crashing in video thumbnailer: Bug #739396

[Jim Nelson <jnelson src gnome org>]

commit 22902f6c831a7bc2f4a228f04c394421137c4061
Author: Jim Nelson <jim yorba org>
Date:   Fri Dec 19 16:22:11 2014 -0800

    Better guards against crashing in video thumbnailer: Bug #739396
    
    For user's video, GStreamer is returning a ridiculously small buffer
    (66 bytes) for a frame it reports to be 1920x1080.  Since Totem's
    thumbnailer works, presumably there's something wrong with ours, but
    these changes at least prevent the thumbnailer from crashing deep
    inside GDK pixbuf.

 thumbnailer/shotwell-video-thumbnailer.vala |   18 +++++++++++++++---
 1 files changed, 15 insertions(+), 3 deletions(-)
---
diff --git a/thumbnailer/shotwell-video-thumbnailer.vala b/thumbnailer/shotwell-video-thumbnailer.vala
index 93db2aa..1202182 100644
--- a/thumbnailer/shotwell-video-thumbnailer.vala
+++ b/thumbnailer/shotwell-video-thumbnailer.vala
@@ -101,19 +101,31 @@ class ShotwellThumbnailer {
                     stderr.printf("Could not get snapshot dimension\n");
                     return 6;
                 }
-
+                
+                if (width <= 0 || height <= 0) {
+                    stderr.printf("Bad frame dimensions: %dx%d\n", width, height);
+                    return 7;
+                }
+                
                 buffer = sample.get_buffer();
                 buffer.map(out mapinfo, Gst.MapFlags.READ);
                 
                 if (mapinfo.data == null || mapinfo.data.length == 0) {
                     stderr.printf("Could not get snapshot data buffer\n");
-                    return 7;
+                    return 8;
+                }
+                
+                int rowstride = (((width * 3)+3)&~3);
+                if (mapinfo.data.length < (rowstride * height)) {
+                    stderr.printf("Frame buffer too small for rowstride and height (%d,%d rowstride=%d 
buffer_size=%d)\n",
+                        width, height, rowstride, mapinfo.data.length);
+                    return 9;
                 }
                 
                 // Create pixmap from buffer and save, gstreamer video buffers have a stride
                 // that is rounded up to the nearest multiple of 4.
                 pixbuf = new Gdk.Pixbuf.from_data(mapinfo.data, Gdk.Colorspace.RGB, false, 8,
-                    width, height, (((width * 3)+3)&~3), null);
+                    width, height, rowstride, null);
                 
                 // Save the pixbuf.
                 pixbuf.save_to_buffer(out pngdata, "png");