diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-26 03:26:59 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-27 03:11:20 +0200 |
| commit | f31fc4755f69ab26bf6e8be47875b7dcede8e29e (patch) | |
| tree | 47d787cef1f58d31e9f9d42a1b44ba6cb85cb622 | |
| parent | 665311ab1f9620a48fb2b6fc8883bb6a0a3f916f (diff) | |
| download | ffmpeg-f31fc4755f69ab26bf6e8be47875b7dcede8e29e.tar.gz | |
avcodec/dnxhddec: Move mb height check out of non hr branch
Fixes: out of array access
Fixes: poc.dnxhd
Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 296debd213bd6dce7647cedd34eb64e5b94cdc92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dnxhddec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c index 18080803fa..bf14869ac9 100644 --- a/libavcodec/dnxhddec.c +++ b/libavcodec/dnxhddec.c @@ -278,14 +278,18 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame, if (header_prefix == DNXHD_HEADER_HR2) { ctx->data_offset = 0x170 + (ctx->mb_height << 2); } else { - if (ctx->mb_height > 68 || - (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) { + if (ctx->mb_height > 68) { av_log(ctx->avctx, AV_LOG_ERROR, "mb height too big: %d\n", ctx->mb_height); return AVERROR_INVALIDDATA; } ctx->data_offset = 0x280; } + if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) { + av_log(ctx->avctx, AV_LOG_ERROR, + "mb height too big: %d\n", ctx->mb_height); + return AVERROR_INVALIDDATA; + } if (buf_size < ctx->data_offset) { av_log(ctx->avctx, AV_LOG_ERROR, |