diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-07 04:32:28 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-07 04:40:37 +0100 |
| commit | 6ef57f4d9a0920c82237facb0d1f3856b17da9dc (patch) | |
| tree | 774ec69c854b3e4910cf303737c933919fc96312 | |
| parent | a18f11158216c22f4a69e44f8cbb59b300a7f10c (diff) | |
| download | ffmpeg-6ef57f4d9a0920c82237facb0d1f3856b17da9dc.tar.gz | |
avcodec/hevc: hls_decode_entry: check that the previous slice segment is available before decoding the next
Fixes use of uninitialized memory
Fixes out of array read
Fixes assertion failure
Fixes part of cb307d24befbd109c6f054008d6777b5/asan_static-oob_124a175_1445_cov_2355279992_DBLK_D_VIXS_1.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hevc.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index 6fcd548016..13d4903487 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -1916,6 +1916,14 @@ static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread) return AVERROR_INVALIDDATA; } + if (s->sh.dependent_slice_segment_flag) { + int prev_rs = s->pps->ctb_addr_ts_to_rs[ctb_addr_ts - 1]; + if (s->tab_slice_address[prev_rs] == -1) { + av_log(s->avctx, AV_LOG_ERROR, "Previous slice segment missing\n"); + return AVERROR_INVALIDDATA; + } + } + while (more_data && ctb_addr_ts < s->sps->ctb_size) { int ctb_addr_rs = s->pps->ctb_addr_ts_to_rs[ctb_addr_ts]; |