diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-17 13:35:10 -0800 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2012-03-06 15:28:01 -0800 |
| commit | 522645e38f6d0aa78ebf3afb356e7427bf4eb248 (patch) | |
| tree | b21790801c10cc052bbd939d568be4730059f45a | |
| parent | e891ee4bf639099c21bb146a734d31ad7f910acf (diff) | |
| download | ffmpeg-522645e38f6d0aa78ebf3afb356e7427bf4eb248.tar.gz | |
h263dec: Disallow width/height changing with frame threads.
Fixes CVE-2011-3937
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 71db86d53b5c6872cea31bf714a1a38ec78feaba)
Conflicts:
libavcodec/h263dec.c
Signed-off-by: Alex Converse <alex.converse@gmail.com>
| -rw-r--r-- | libavcodec/h263dec.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index f056d1fbe2..ba0ea4f9f9 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -556,8 +556,7 @@ retry: #if HAVE_MMX if (s->codec_id == CODEC_ID_MPEG4 && s->xvid_build>=0 && avctx->idct_algo == FF_IDCT_AUTO && (av_get_cpu_flags() & AV_CPU_FLAG_MMX)) { avctx->idct_algo= FF_IDCT_XVIDMMX; - avctx->coded_width= 0; // force reinit -// dsputil_init(&s->dsp, avctx); + ff_dct_common_init(s); s->picture_number=0; } #endif @@ -571,6 +570,12 @@ retry: || s->height != avctx->coded_height) { /* H.263 could change picture size any time */ ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat + + if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) { + av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0); + return -1; // width / height changed during parallelized decoding + } + s->parse_context.buffer=0; MPV_common_end(s); s->parse_context= pc; |