diff options
| author | James Almer <jamrial@gmail.com> | 2023-04-13 10:19:57 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2023-04-14 10:04:47 -0300 |
| commit | 7c6e26a18403376987541f1ca801ae225f8ee6d4 (patch) | |
| tree | db0818413aa3aeaa0f0fca1bd4a72c921be33d23 /libavcodec/motion_est.c | |
| parent | 5cda6b94f45c347805cbd5a0c7ed1d712b5722d7 (diff) | |
| download | ffmpeg-7c6e26a18403376987541f1ca801ae225f8ee6d4.tar.gz | |
avcodec/mp_cmp: reject invalid comparison function values
Fixes tickets #10306 and #10318.
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavcodec/motion_est.c')
| -rw-r--r-- | libavcodec/motion_est.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/libavcodec/motion_est.c b/libavcodec/motion_est.c index d17ffe42b4..df9d1befa8 100644 --- a/libavcodec/motion_est.c +++ b/libavcodec/motion_est.c @@ -309,6 +309,7 @@ int ff_init_me(MpegEncContext *s){ MotionEstContext * const c= &s->me; int cache_size= FFMIN(ME_MAP_SIZE>>ME_MAP_SHIFT, 1<<ME_MAP_SHIFT); int dia_size= FFMAX(FFABS(s->avctx->dia_size)&255, FFABS(s->avctx->pre_dia_size)&255); + int ret; if(FFMIN(s->avctx->dia_size, s->avctx->pre_dia_size) < -FFMIN(ME_MAP_SIZE, MAX_SAB_SIZE)){ av_log(s->avctx, AV_LOG_ERROR, "ME_MAP size is too small for SAB diamond\n"); @@ -324,10 +325,12 @@ int ff_init_me(MpegEncContext *s){ av_log(s->avctx, AV_LOG_INFO, "ME_MAP size may be a little small for the selected diamond size\n"); } - ff_set_cmp(&s->mecc, s->mecc.me_pre_cmp, c->avctx->me_pre_cmp); - ff_set_cmp(&s->mecc, s->mecc.me_cmp, c->avctx->me_cmp); - ff_set_cmp(&s->mecc, s->mecc.me_sub_cmp, c->avctx->me_sub_cmp); - ff_set_cmp(&s->mecc, s->mecc.mb_cmp, c->avctx->mb_cmp); + ret = ff_set_cmp(&s->mecc, s->mecc.me_pre_cmp, c->avctx->me_pre_cmp); + ret |= ff_set_cmp(&s->mecc, s->mecc.me_cmp, c->avctx->me_cmp); + ret |= ff_set_cmp(&s->mecc, s->mecc.me_sub_cmp, c->avctx->me_sub_cmp); + ret |= ff_set_cmp(&s->mecc, s->mecc.mb_cmp, c->avctx->mb_cmp); + if (ret < 0) + return ret; c->flags = get_flags(c, 0, c->avctx->me_cmp &FF_CMP_CHROMA); c->sub_flags= get_flags(c, 0, c->avctx->me_sub_cmp&FF_CMP_CHROMA); |