[FFmpeg-cvslog] avcodec/dnxhddec: Move mb height check out of non hr branch
Michael Niedermayer
git at videolan.org
Thu Jul 27 04:52:17 EEST 2017
ffmpeg | branch: release/3.3 | Michael Niedermayer <michael at niedermayer.cc> | Wed Jul 26 03:26:59 2017 +0200| [47c0626ec721749b28df1c61c481e318e50058e4] | committer: Michael Niedermayer
avcodec/dnxhddec: Move mb height check out of non hr branch
Fixes: out of array access
Fixes: poc.dnxhd
Found-by: Bingchang, Liu at VARAS of IIE
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 296debd213bd6dce7647cedd34eb64e5b94cdc92)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47c0626ec721749b28df1c61c481e318e50058e4
---
libavcodec/dnxhddec.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index 383e64ca9e..7cb6a75261 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -298,14 +298,18 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
if (ctx->mb_height > 68 && ff_dnxhd_check_header_prefix_hr(header_prefix)) {
ctx->data_offset = 0x170 + (ctx->mb_height << 2);
} else {
- if (ctx->mb_height > 68 ||
- (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+ if (ctx->mb_height > 68) {
av_log(ctx->avctx, AV_LOG_ERROR,
"mb height too big: %d\n", ctx->mb_height);
return AVERROR_INVALIDDATA;
}
ctx->data_offset = 0x280;
}
+ if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+ av_log(ctx->avctx, AV_LOG_ERROR,
+ "mb height too big: %d\n", ctx->mb_height);
+ return AVERROR_INVALIDDATA;
+ }
if (buf_size < ctx->data_offset) {
av_log(ctx->avctx, AV_LOG_ERROR,
More information about the ffmpeg-cvslog
mailing list