har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

h264: Check gray scale CBP, fix out of array accesses.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-18 21:36:06 +01:00
parent 27d39c225b
commit 8a03a60b4a
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/h264_cabac.c
View File

@ -2266,6 +2266,11 @@ decode_intra_mb:
cbp = decode_cabac_mb_cbp_luma( h ); cbp = decode_cabac_mb_cbp_luma( h );
if(decode_chroma) if(decode_chroma)
cbp |= decode_cabac_mb_cbp_chroma( h ) << 4; cbp |= decode_cabac_mb_cbp_chroma( h ) << 4;
} else {
if (!decode_chroma && cbp>15) {
av_log(s->avctx, AV_LOG_ERROR, "gray chroma\n");
return AVERROR_INVALIDDATA;
}
} }
h->cbp_table[mb_xy] = h->cbp = cbp; h->cbp_table[mb_xy] = h->cbp = cbp;

5
libavcodec/h264_cavlc.c
View File

@ -1070,6 +1070,11 @@ decode_intra_mb:
if(IS_INTRA4x4(mb_type)) cbp= golomb_to_intra4x4_cbp_gray[cbp]; if(IS_INTRA4x4(mb_type)) cbp= golomb_to_intra4x4_cbp_gray[cbp];
else cbp= golomb_to_inter_cbp_gray[cbp]; else cbp= golomb_to_inter_cbp_gray[cbp];
} }
} else {
if (!decode_chroma && cbp>15) {
av_log(s->avctx, AV_LOG_ERROR, "gray chroma\n");
return AVERROR_INVALIDDATA;
}
} }
if(dct8x8_allowed && (cbp&15) && !IS_INTRA(mb_type)){ if(dct8x8_allowed && (cbp&15) && !IS_INTRA(mb_type)){