diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-12-18 03:16:39 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-01-20 03:27:17 +0100 |
| commit | f1d59a207fef0df648b0489ae54f57436fbdf45a (patch) | |
| tree | 4fa6baec9bda17f5f7e589e52489b028ba2a6df4 | |
| parent | 85b2396265f0be1ff3349e4bfafdf51949839910 (diff) | |
| download | ffmpeg-f1d59a207fef0df648b0489ae54f57436fbdf45a.tar.gz | |
avcodec/h264: Check *log2_weight_denom
Fixes undefined behavior
Fixes: signal_sigsegv_14768d2_2248_cov_3629497219_h264_h264___pi_20070614T182942.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61296d41e2de3b41304339e4631dd44c2e15f805)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index ab4d211be6..885de45687 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2707,6 +2707,16 @@ int ff_pred_weight_table(H264Context *h) h->luma_log2_weight_denom = get_ue_golomb(&h->gb); if (h->sps.chroma_format_idc) h->chroma_log2_weight_denom = get_ue_golomb(&h->gb); + + if (h->luma_log2_weight_denom > 7U) { + av_log(h->avctx, AV_LOG_ERROR, "luma_log2_weight_denom %d is out of range\n", h->luma_log2_weight_denom); + h->luma_log2_weight_denom = 0; + } + if (h->chroma_log2_weight_denom > 7U) { + av_log(h->avctx, AV_LOG_ERROR, "chroma_log2_weight_denom %d is out of range\n", h->chroma_log2_weight_denom); + h->chroma_log2_weight_denom = 0; + } + luma_def = 1 << h->luma_log2_weight_denom; chroma_def = 1 << h->chroma_log2_weight_denom; |