diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-17 13:35:10 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-05-22 22:19:41 +0200 |
| commit | 3313f31f012a434a7c7aac6cb2c554d5cbac88fc (patch) | |
| tree | 1fb5580cd313d89fb7482ee62eb77542a3768822 /libavcodec/h263dec.c | |
| parent | c71c77e56fcc6d469d45e1c8ce04aa053124d3f8 (diff) | |
| download | ffmpeg-3313f31f012a434a7c7aac6cb2c554d5cbac88fc.tar.gz | |
h263dec: Disallow width/height changing with frame threads.
Fixes CVE-2011-3937
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 71db86d53b5c6872cea31bf714a1a38ec78feaba)
Conflicts:
libavcodec/h263dec.c
Signed-off-by: Alex Converse <alex.converse@gmail.com>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 4be63587e110c05cda3101abf2e3745d919f3fae)
Conflicts:
libavcodec/h263dec.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec/h263dec.c')
| -rw-r--r-- | libavcodec/h263dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/h263dec.c b/libavcodec/h263dec.c index 021e172c68..15fc724e54 100644 --- a/libavcodec/h263dec.c +++ b/libavcodec/h263dec.c @@ -574,6 +574,11 @@ retry: /* H.263 could change picture size any time */ ParseContext pc= s->parse_context; //FIXME move these demuxng hack to avformat + if (HAVE_THREADS && (s->avctx->active_thread_type&FF_THREAD_FRAME)) { + av_log_missing_feature(s->avctx, "Width/height/bit depth/chroma idc changing with threads is", 0); + return -1; // width / height changed during parallelized decoding + } + s->parse_context.buffer=0; MPV_common_end(s); s->parse_context= pc; |