diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-09-24 23:49:30 +0200 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2015-10-09 21:46:03 +0200 |
| commit | ef6d6f89067d17d1187fc1d82b418c63b88cbba6 (patch) | |
| tree | 69fabbc624a25a84022ddeb63b04d8b84da3a5db /libavcodec/ffv1dec.c | |
| parent | b0b37e018b384776f76cb1be91fa3e5a5099e8d9 (diff) | |
| download | ffmpeg-ef6d6f89067d17d1187fc1d82b418c63b88cbba6.tar.gz | |
avcodec/ffv1: seperate slice_count from max_slice_count
Fix segfault with too large slice_count
Fixes Ticket4879
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa6c43f3fdec8a7518534b9dab20c9eb4be11568)
Conflicts:
libavcodec/ffv1enc.c
libavcodec/ffv1.c
Diffstat (limited to 'libavcodec/ffv1dec.c')
| -rw-r--r-- | libavcodec/ffv1dec.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index c3667914fd..55be6dee5b 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -770,6 +770,7 @@ static int read_header(FFV1Context *f) av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n"); return AVERROR_INVALIDDATA; } + f->slice_count = f->max_slice_count; } else if (f->version < 3) { f->slice_count = get_symbol(c, state, 0); } else { @@ -784,8 +785,8 @@ static int read_header(FFV1Context *f) p -= size + trailer; } } - if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0) { - av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count); + if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) { + av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count); return AVERROR_INVALIDDATA; } @@ -1008,6 +1009,7 @@ static int init_thread_copy(AVCodecContext *avctx) f->picture.f = NULL; f->last_picture.f = NULL; f->sample_buffer = NULL; + f->max_slice_count = 0; f->slice_count = 0; for (i = 0; i < f->quant_table_count; i++) { @@ -1083,7 +1085,7 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src) av_assert0(!fdst->sample_buffer); } - av_assert1(fdst->slice_count == fsrc->slice_count); + av_assert1(fdst->max_slice_count == fsrc->max_slice_count); ff_thread_release_buffer(dst, &fdst->picture); |