aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAnton Khirnov <anton@khirnov.net>2013-11-28 10:54:35 +0100
committerSean McGovern <gseanmcg@gmail.com>2014-04-14 16:55:38 -0400
commit7f604a048e9b6128cdf9ce7e95f21d1a9822ba39 (patch)
tree123726105b61d6bf9d535ce860c89faca18c756e
parent7e513d85e80d730718695d09fcaf0295ae24699e (diff)
downloadffmpeg-7f604a048e9b6128cdf9ce7e95f21d1a9822ba39.tar.gz
h264: reject mismatching luma/chroma bit depths during sps parsing
There is no point in delaying the check and it avoids bugs with a half-initialized context. Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
-rw-r--r--libavcodec/h264.c6
-rw-r--r--libavcodec/h264_ps.c5
2 files changed, 5 insertions, 6 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index b5f4493c57..38764d1814 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2427,12 +2427,6 @@ static int h264_set_parameter_from_sps(H264Context *h)
if (s->avctx->has_b_frames < 2)
s->avctx->has_b_frames = !s->low_delay;
- if (h->sps.bit_depth_luma != h->sps.bit_depth_chroma) {
- av_log_missing_feature(s->avctx,
- "Different bit depth between chroma and luma", 1);
- return AVERROR_PATCHWELCOME;
- }
-
if (s->avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||
h->cur_chroma_format_idc != h->sps.chroma_format_idc) {
if (s->avctx->codec &&
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
index fad2d7735b..a1dfbda9c8 100644
--- a/libavcodec/h264_ps.c
+++ b/libavcodec/h264_ps.c
@@ -349,6 +349,11 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
}
sps->bit_depth_luma = get_ue_golomb(&s->gb) + 8;
sps->bit_depth_chroma = get_ue_golomb(&s->gb) + 8;
+ if (sps->bit_depth_chroma != sps->bit_depth_luma) {
+ av_log_missing_feature(s->avctx,
+ "Different bit depth between chroma and luma", 1);
+ goto fail;
+ }
sps->transform_bypass = get_bits1(&s->gb);
decode_scaling_matrices(h, sps, NULL, 1, sps->scaling_matrix4, sps->scaling_matrix8);
}else{