diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-18 21:36:06 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-18 23:02:46 +0100 |
| commit | 8a03a60b4af46c001d5686b9303f48f6c4ebdf6c (patch) | |
| tree | 6a5bd2343266c1aae55515fd0dc3366180769bcc /libavcodec/h264_cabac.c | |
| parent | 27d39c225bb35e25431f562160cf28f3aacdb3c7 (diff) | |
| download | ffmpeg-8a03a60b4af46c001d5686b9303f48f6c4ebdf6c.tar.gz | |
h264: Check gray scale CBP, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264_cabac.c')
| -rw-r--r-- | libavcodec/h264_cabac.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/h264_cabac.c b/libavcodec/h264_cabac.c index a37094b3f5..76a648143d 100644 --- a/libavcodec/h264_cabac.c +++ b/libavcodec/h264_cabac.c @@ -2266,6 +2266,11 @@ decode_intra_mb: cbp = decode_cabac_mb_cbp_luma( h ); if(decode_chroma) cbp |= decode_cabac_mb_cbp_chroma( h ) << 4; + } else { + if (!decode_chroma && cbp>15) { + av_log(s->avctx, AV_LOG_ERROR, "gray chroma\n"); + return AVERROR_INVALIDDATA; + } } h->cbp_table[mb_xy] = h->cbp = cbp; |