diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-29 16:37:09 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-05-04 22:09:27 +0200 |
| commit | 746f1594d71dece6fd6f786447e19be9c200a07d (patch) | |
| tree | 674d2e48b70052acc80e73d04de8bdb926ac01fd | |
| parent | 0e4bb0530f7d4cb1343499ee2bf0cb943d3b9a41 (diff) | |
| download | ffmpeg-746f1594d71dece6fd6f786447e19be9c200a07d.tar.gz | |
h264: additional protection against unsupported size/bitdepth changes.
Fixes crashes in codepaths not covered by original checks.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 732f9fcfe54fc9a0a7bbce53fe86b38744c2d301)
Conflicts:
libavcodec/h264.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/h264.c | 4 | ||||
| -rw-r--r-- | libavcodec/h264_ps.c | 3 |
2 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index e0eb8e119d..b229510269 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2723,9 +2723,9 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ if (s->context_initialized && ( s->width != s->avctx->width || s->height != s->avctx->height || av_cmp_q(h->sps.sar, s->avctx->sample_aspect_ratio))) { - if(h != h0) { + if(h != h0 || (HAVE_THREADS && h->s.avctx->active_thread_type & FF_THREAD_FRAME)) { av_log_missing_feature(s->avctx, "Width/height changing with threads is", 0); - return -1; // width / height changed during parallelized decoding + return AVERROR_PATCHWELCOME; // width / height changed during parallelized decoding } free_tables(h, 0); flush_dpb(s->avctx); diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 276eb77d1d..c6623a97ef 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -471,6 +471,9 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length){ if(pps_id >= MAX_PPS_COUNT) { av_log(h->s.avctx, AV_LOG_ERROR, "pps_id (%d) out of range\n", pps_id); return -1; + } else if (h->sps.bit_depth_luma > 10) { + av_log(h->s.avctx, AV_LOG_ERROR, "Unimplemented luma bit depth=%d (max=10)\n", h->sps.bit_depth_luma); + return AVERROR_PATCHWELCOME; } pps= av_mallocz(sizeof(PPS)); |