[FFmpeg-cvslog] h264: straighten dimensions check ff_h264_decode_seq_parameter_set

[Benoit Fouet]

ffmpeg | branch: master | Benoit Fouet <benoit.fouet at free.fr> | Mon Jun 27 13:31:21 2016 +0200| [4cc1ce4a91788a71670ea43fa0026b5a969e9e9e] | committer: Benoit Fouet

h264: straighten dimensions check ff_h264_decode_seq_parameter_set

The MBS only flag was not taken into account when checking macroblock dimensions.
Also removes the unneeded check in init_dimensions for slices.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4cc1ce4a91788a71670ea43fa0026b5a969e9e9e
---

 libavcodec/h264_ps.c    |   15 ++++++++-------
 libavcodec/h264_slice.c |   17 -----------------
 2 files changed, 8 insertions(+), 24 deletions(-)

diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
index 2f166c5..76ac9f1 100644
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -464,13 +464,6 @@ int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx,
     sps->gaps_in_frame_num_allowed_flag = get_bits1(gb);
     sps->mb_width                       = get_ue_golomb(gb) + 1;
     sps->mb_height                      = get_ue_golomb(gb) + 1;
-    if ((unsigned)sps->mb_width  >= INT_MAX / 16 ||
-        (unsigned)sps->mb_height >= INT_MAX / 16 ||
-        av_image_check_size(16 * sps->mb_width,
-                            16 * sps->mb_height, 0, avctx)) {
-        av_log(avctx, AV_LOG_ERROR, "mb_width/height overflow\n");
-        goto fail;
-    }
 
     sps->frame_mbs_only_flag = get_bits1(gb);
     if (!sps->frame_mbs_only_flag)
@@ -478,6 +471,14 @@ int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx,
     else
         sps->mb_aff = 0;
 
+    if ((unsigned)sps->mb_width  >= INT_MAX / 16 ||
+        (unsigned)sps->mb_height >= INT_MAX / (16 * (2 - sps->frame_mbs_only_flag)) ||
+        av_image_check_size(16 * sps->mb_width,
+                            16 * sps->mb_height * (2 - sps->frame_mbs_only_flag), 0, avctx)) {
+        av_log(avctx, AV_LOG_ERROR, "mb_width/height overflow\n");
+        goto fail;
+    }
+
     sps->direct_8x8_inference_flag = get_bits1(gb);
 
 #ifndef ALLOW_INTERLACE
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index adbd1d8..6babd66 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -889,23 +889,6 @@ static int init_dimensions(H264Context *h)
         height = h->avctx->height;
     }
 
-    if (width <= 0 || height <= 0) {
-        av_log(h->avctx, AV_LOG_ERROR, "Invalid cropped dimensions: %dx%d.\n",
-               width, height);
-        if (h->avctx->err_recognition & AV_EF_EXPLODE)
-            return AVERROR_INVALIDDATA;
-
-        av_log(h->avctx, AV_LOG_WARNING, "Ignoring cropping information.\n");
-        sps->crop_bottom =
-        sps->crop_top    =
-        sps->crop_right  =
-        sps->crop_left   =
-        sps->crop        = 0;
-
-        width  = h->width;
-        height = h->height;
-    }
-
     h->avctx->coded_width  = h->width;
     h->avctx->coded_height = h->height;
     h->avctx->width        = width;