From 47b7c68ae54560e2308bdb6be4fb076c73b93081 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 31 Mar 2018 03:10:43 +0200 Subject: [PATCH] avcodec/utvideodec: Set pro flag based on fourcc This avoids mixing 8bit variants with pro and 10bit with non pro mode. Fixes: out of array read Fixes: poc_03_30.avi Found-by: GwanYeong Kim Reviewed-by: Paul B Mahol Signed-off-by: Michael Niedermayer --- libavcodec/utvideodec.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavcodec/utvideodec.c b/libavcodec/utvideodec.c index 086129d094..82cb038ccd 100644 --- a/libavcodec/utvideodec.c +++ b/libavcodec/utvideodec.c @@ -949,14 +949,17 @@ static av_cold int decode_init(AVCodecContext *avctx) break; case MKTAG('U', 'Q', 'Y', '2'): c->planes = 3; + c->pro = 1; avctx->pix_fmt = AV_PIX_FMT_YUV422P10; break; case MKTAG('U', 'Q', 'R', 'G'): c->planes = 3; + c->pro = 1; avctx->pix_fmt = AV_PIX_FMT_GBRP10; break; case MKTAG('U', 'Q', 'R', 'A'): c->planes = 4; + c->pro = 1; avctx->pix_fmt = AV_PIX_FMT_GBRAP10; break; case MKTAG('U', 'L', 'H', '0'): @@ -1031,7 +1034,7 @@ static av_cold int decode_init(AVCodecContext *avctx) if (c->compression != 2) avpriv_request_sample(avctx, "Unknown compression type"); c->slices = avctx->extradata[9] + 1; - } else if (avctx->extradata_size >= 16) { + } else if (!c->pro && avctx->extradata_size >= 16) { av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n", avctx->extradata[3], avctx->extradata[2], avctx->extradata[1], avctx->extradata[0]); @@ -1046,14 +1049,13 @@ static av_cold int decode_init(AVCodecContext *avctx) c->slices = (c->flags >> 24) + 1; c->compression = c->flags & 1; c->interlaced = c->flags & 0x800; - } else if (avctx->extradata_size == 8) { + } else if (c->pro && avctx->extradata_size == 8) { av_log(avctx, AV_LOG_DEBUG, "Encoder version %d.%d.%d.%d\n", avctx->extradata[3], avctx->extradata[2], avctx->extradata[1], avctx->extradata[0]); av_log(avctx, AV_LOG_DEBUG, "Original format %"PRIX32"\n", AV_RB32(avctx->extradata + 4)); c->interlaced = 0; - c->pro = 1; c->frame_info_size = 4; } else { av_log(avctx, AV_LOG_ERROR,