diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-29 12:24:10 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-05-06 21:40:58 +0200 |
| commit | 3fc967f6c7ab2a21e9e4cca93487286b431cd64a (patch) | |
| tree | 844b792dedde1696ffdba3387c74267af326ca87 | |
| parent | 26ac878cc206462de307d85466bc43972e264aee (diff) | |
| download | ffmpeg-3fc967f6c7ab2a21e9e4cca93487286b431cd64a.tar.gz | |
h263: more strictly forbid frame size changes with frame-mt.
Prevents crashes because the old check was incomplete.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 2d22d4307dcc1461f39a2ffb9c8db6c6b23fd080)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 7fe4c8cb761b0fc8685dacf9f187311b9d124a52)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/h263dec.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index abdaf2bf24..021e172c68 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -426,6 +426,13 @@ retry: if (ret < 0){ av_log(s->avctx, AV_LOG_ERROR, "header damaged\n"); return -1; + } else if ((s->width != avctx->coded_width || + s->height != avctx->coded_height || + (s->width + 15) >> 4 != s->mb_width || + (s->height + 15) >> 4 != s->mb_height) && + (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME))) { + av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0); + return AVERROR_PATCHWELCOME; // width / height changed during parallelized decoding } avctx->has_b_frames= !s->low_delay; @@ -567,11 +574,6 @@ retry: /* H.263 could change picture size any time */ ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat - if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) { - av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0); - return -1; // width / height changed during parallelized decoding - } - s->parse_context.buffer=0; MPV_common_end(s); s->parse_context= pc; |