diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-09-10 16:28:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-11 04:57:46 +0200 |
| commit | 23f5cff92cdcfa55a735c458fcb5f95c0e0f3b1f (patch) | |
| tree | b904aabaaec47c51869dbdc7770efe2f4d65f0ca | |
| parent | 28ccda78236babf500330d1fbf0b7c230bdbdeb6 (diff) | |
| download | ffmpeg-23f5cff92cdcfa55a735c458fcb5f95c0e0f3b1f.tar.gz | |
h264dec: Prevent CABAC and CAVLC bitsteram overreading
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 18 | ||||
| -rw-r--r-- | libavcodec/h264.h | 2 |
2 files changed, 13 insertions, 7 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 118334ad7c..958c859c72 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -174,20 +174,24 @@ const uint8_t *ff_h264_decode_nal(H264Context *h, const uint8_t *src, int *dst_l i-= RS; } - if(i>=length-1){ //no escaped 0 - *dst_length= length; - *consumed= length+1; //+1 for the header - return src; - } - bufidx = h->nal_unit_type == NAL_DPC ? 1 : 0; // use second escape buffer for inter data - av_fast_malloc(&h->rbsp_buffer[bufidx], &h->rbsp_buffer_size[bufidx], length+FF_INPUT_BUFFER_PADDING_SIZE); + si=h->rbsp_buffer_size[bufidx]; + av_fast_malloc(&h->rbsp_buffer[bufidx], &h->rbsp_buffer_size[bufidx], length+FF_INPUT_BUFFER_PADDING_SIZE+MAX_MBPAIR_SIZE); dst= h->rbsp_buffer[bufidx]; + if(si != h->rbsp_buffer_size[bufidx]) + memset(dst + length, 0, FF_INPUT_BUFFER_PADDING_SIZE+MAX_MBPAIR_SIZE); if (dst == NULL){ return NULL; } + if(i>=length-1){ //no escaped 0 + *dst_length= length; + *consumed= length+1; //+1 for the header + memcpy(dst, src, length); + return dst; + } + //printf("decoding esc\n"); memcpy(dst, src, i); si=di=i; diff --git a/libavcodec/h264.h b/libavcodec/h264.h index 2809e3253e..e956d3a339 100644 --- a/libavcodec/h264.h +++ b/libavcodec/h264.h @@ -46,6 +46,8 @@ #define MAX_DELAYED_PIC_COUNT 16 +#define MAX_MBPAIR_SIZE (256*1024) // a tighter bound could be calculated if someone cares about a few bytes + /* Compiling in interlaced support reduces the speed * of progressive decoding by about 2%. */ #define ALLOW_INTERLACE |