diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-09 22:57:01 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-09 22:57:01 -0800 |
| commit | 45b7bd7c53b41bc5ff6fc2158831f2b1b1256113 (patch) | |
| tree | 51923d7569c3c823380fcca869fa8361055dcc3e /libavcodec/svq3.c | |
| parent | 81749f30cd84b35f774d7d1bbe6bf3f96e2362c8 (diff) | |
| download | ffmpeg-45b7bd7c53b41bc5ff6fc2158831f2b1b1256113.tar.gz | |
h264: disallow constrained intra prediction modes for luma.
Conversion of the luma intra prediction mode to one of the constrained
("alzheimer") ones can happen by crafting special bitstreams, causing
a crash because we'll call a NULL function pointer for 16x16 block intra
prediction, since constrained intra prediction functions are only
implemented for chroma (8x8 blocks).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/svq3.c')
| -rw-r--r-- | libavcodec/svq3.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 3cd95ba594..5cc57a745d 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -612,7 +612,7 @@ static int svq3_decode_mb(SVQ3Context *svq3, unsigned int mb_type) dir = i_mb_type_info[mb_type - 8].pred_mode; dir = (dir >> 1) ^ 3*(dir & 1) ^ 1; - if ((h->intra16x16_pred_mode = ff_h264_check_intra_pred_mode(h, dir)) == -1){ + if ((h->intra16x16_pred_mode = ff_h264_check_intra_pred_mode(h, dir, 0)) == -1){ av_log(h->s.avctx, AV_LOG_ERROR, "check_intra_pred_mode = -1\n"); return -1; } @@ -711,7 +711,7 @@ static int svq3_decode_mb(SVQ3Context *svq3, unsigned int mb_type) s->current_picture.f.mb_type[mb_xy] = mb_type; if (IS_INTRA(mb_type)) { - h->chroma_pred_mode = ff_h264_check_intra_pred_mode(h, DC_PRED8x8); + h->chroma_pred_mode = ff_h264_check_intra_pred_mode(h, DC_PRED8x8, 1); } return 0; |