diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-06 01:37:34 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 00:52:56 +0100 |
| commit | 15a736483e3cb672e343ab3ffb78281675896d6f (patch) | |
| tree | 2a87494c8574f4b1d49a62e71505045ca4f30396 | |
| parent | c8b90c7cd52600bbfb403793d6665fc90ad78946 (diff) | |
| download | ffmpeg-15a736483e3cb672e343ab3ffb78281675896d6f.tar.gz | |
h264: check mb_width/height
Fixes inconsistency that leads to out of array accesses with threads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5a9e3760495e8678ae87314670e3d9d5a1792c8d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 4ecfa40466..001882b7cd 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3208,7 +3208,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0) || 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height || h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma || h->cur_chroma_format_idc != h->sps.chroma_format_idc - || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio))); + || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio) + || h->mb_width != h->sps.mb_width + || h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) + )); if (h0->avctx->pix_fmt != get_pixel_format(h0, 0)) must_reinit = 1; |