diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-06 01:37:34 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-06 01:58:10 +0200 |
| commit | 5a9e3760495e8678ae87314670e3d9d5a1792c8d (patch) | |
| tree | c14d6b5bcff46f1c9bdd811f2eb64e26288b02f9 /libavcodec/h264.c | |
| parent | edabbfbaf2c9bc478edc6169cd7714da68ba70b5 (diff) | |
| download | ffmpeg-5a9e3760495e8678ae87314670e3d9d5a1792c8d.tar.gz | |
h264: check mb_width/height
Fixes inconsistency that leads to out of array accesses with threads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264.c')
| -rw-r--r-- | libavcodec/h264.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index d4a6c6a4f5..3d3746f003 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3310,7 +3310,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0) || 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height || h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma || h->cur_chroma_format_idc != h->sps.chroma_format_idc - || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio))); + || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio) + || h->mb_width != h->sps.mb_width + || h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) + )); if (h0->avctx->pix_fmt != get_pixel_format(h0, 0)) must_reinit = 1; |