diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-03 23:52:38 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-23 14:49:37 +0100 |
| commit | 9330bcff9ba2e74cc13630cb607a11753c1c212c (patch) | |
| tree | ab8e89c3851a24c1fb8b29897ae04cbe7a5f9af9 | |
| parent | 9fb364babdc7788bf955100958ef596448e5c1b1 (diff) | |
| download | ffmpeg-9330bcff9ba2e74cc13630cb607a11753c1c212c.tar.gz | |
avcodec/h264: Disallow pps_id changing between slices
Such changes are forbidden in H.264 and lead to race conditions
Fixes out of array read
Fixes: signal_sigsegv_f9796a_1613_cov_3114610371_FM1_BT_B.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e708424b70bef8641e8a090ec4d9e8c4490db87e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 10 | ||||
| -rw-r--r-- | libavcodec/h264.h | 2 |
2 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 76a82acafb..7b240a22fd 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3430,6 +3430,12 @@ static int decode_slice_header(H264Context *h, H264Context *h0) pps_id); return AVERROR_INVALIDDATA; } + if (h0->au_pps_id >= 0 && pps_id != h0->au_pps_id) { + av_log(h->avctx, AV_LOG_ERROR, + "PPS change from %d to %d forbidden\n", + h0->au_pps_id, pps_id); + return AVERROR_INVALIDDATA; + } h->pps = *h0->pps_buffers[pps_id]; if (!h0->sps_buffers[h->pps.sps_id]) { @@ -4022,6 +4028,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0) if (h->ref_count[0]) h->er.last_pic = &h->ref_list[0][0]; if (h->ref_count[1]) h->er.next_pic = &h->ref_list[1][0]; h->er.ref_count = h->ref_count[0]; + h0->au_pps_id = pps_id; if (h->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(h->avctx, AV_LOG_DEBUG, @@ -4788,6 +4795,9 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size, continue; again: + if ( !(avctx->active_thread_type & FF_THREAD_FRAME) + || nals_needed >= nal_index) + h->au_pps_id = -1; /* Ignore per frame NAL unit type during extradata * parsing. Decoding slices is not possible in codec init * with frame-mt */ diff --git a/libavcodec/h264.h b/libavcodec/h264.h index ed7f04b853..63a343774c 100644 --- a/libavcodec/h264.h +++ b/libavcodec/h264.h @@ -390,6 +390,8 @@ typedef struct H264Context { */ PPS pps; // FIXME move to Picture perhaps? (->no) do we need that? + int au_pps_id; ///< pps_id of current access unit + uint32_t dequant4_buffer[6][QP_MAX_NUM + 1][16]; // FIXME should these be moved down? uint32_t dequant8_buffer[6][QP_MAX_NUM + 1][64]; uint32_t(*dequant4_coeff[6])[16]; |