[FFmpeg-cvslog] vc1dec: Do not allow field_mode to change after the first header
Michael Niedermayer
git at videolan.org
Wed May 15 20:21:23 CEST 2013
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Nov 16 00:48:15 2012 +0100| [4162fc62b30d5b57910c17e46f2a9319a09cdae0] | committer: Martin Storsjö
vc1dec: Do not allow field_mode to change after the first header
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin at martin.st>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4162fc62b30d5b57910c17e46f2a9319a09cdae0
---
libavcodec/vc1.c | 17 +++++++++++------
libavcodec/vc1.h | 1 +
libavcodec/vc1dec.c | 2 ++
3 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index 25e3579..86651fe 100644
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -825,6 +825,7 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
int status;
int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */
int scale, shift, i; /* for initializing LUT for intensity compensation */
+ int field_mode, fcm;
v->p_frame_skipped = 0;
if (v->second_field) {
@@ -836,19 +837,23 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb)
goto parse_common_info;
}
- v->field_mode = 0;
+ field_mode = 0;
if (v->interlace) {
- v->fcm = decode012(gb);
- if (v->fcm) {
- if (v->fcm == ILACE_FIELD)
- v->field_mode = 1;
+ fcm = decode012(gb);
+ if (fcm) {
+ if (fcm == ILACE_FIELD)
+ field_mode = 1;
if (!v->warn_interlaced++)
av_log(v->s.avctx, AV_LOG_ERROR,
"Interlaced frames/fields support is incomplete\n");
}
} else {
- v->fcm = PROGRESSIVE;
+ fcm = PROGRESSIVE;
}
+ if (!v->first_pic_header_flag && v->field_mode != field_mode)
+ return AVERROR_INVALIDDATA;
+ v->field_mode = field_mode;
+ v->fcm = fcm;
if (v->field_mode) {
v->fptype = get_bits(gb, 3);
diff --git a/libavcodec/vc1.h b/libavcodec/vc1.h
index 6f24c0e..88980d4 100644
--- a/libavcodec/vc1.h
+++ b/libavcodec/vc1.h
@@ -372,6 +372,7 @@ typedef struct VC1Context{
int qs_last; ///< if qpel has been used in the previous (tr.) picture
int bmvtype;
int frfd, brfd; ///< reference frame distance (forward or backward)
+ int first_pic_header_flag;
int pic_header_flag;
/** Frame decoding info for sprite modes */
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 86806b1..7345d53 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -5463,6 +5463,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
// do parse frame header
v->pic_header_flag = 0;
+ v->first_pic_header_flag = 1;
if (v->profile < PROFILE_ADVANCED) {
if (ff_vc1_parse_frame_header(v, &s->gb) < 0) {
goto err;
@@ -5472,6 +5473,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
goto err;
}
}
+ v->first_pic_header_flag = 0;
if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE)
&& s->pict_type != AV_PICTURE_TYPE_I) {
More information about the ffmpeg-cvslog
mailing list