diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2014-01-10 21:38:38 -0500 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-11 22:35:14 +0100 |
| commit | 0065d2d520caab2321b35a7bec5d62564913238b (patch) | |
| tree | befcd4373108a8cfb5e5e806f6bd1a9650e9bc05 /libavcodec/vp9.c | |
| parent | 7dc0aba3fb9d017e0e6ac7fbdc596bc40214a318 (diff) | |
| download | ffmpeg-0065d2d520caab2321b35a7bec5d62564913238b.tar.gz | |
vp9: fix mt-related hang a parser infinite loop.
Fixes trac ticket 3274.
Looked-at-by: ubitux
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vp9.c')
| -rw-r--r-- | libavcodec/vp9.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/vp9.c b/libavcodec/vp9.c index bba600b73d..ec6ceb010d 100644 --- a/libavcodec/vp9.c +++ b/libavcodec/vp9.c @@ -3592,11 +3592,15 @@ static int vp9_decode_frame(AVCodecContext *ctx, void *frame, data += 4; size -= 4; } - if (tile_size > size) + if (tile_size > size) { + ff_thread_report_progress(&s->frames[CUR_FRAME].tf, INT_MAX, 0); return AVERROR_INVALIDDATA; + } ff_vp56_init_range_decoder(&s->c_b[tile_col], data, tile_size); - if (vp56_rac_get_prob_branchy(&s->c_b[tile_col], 128)) // marker bit + if (vp56_rac_get_prob_branchy(&s->c_b[tile_col], 128)) { // marker bit + ff_thread_report_progress(&s->frames[CUR_FRAME].tf, INT_MAX, 0); return AVERROR_INVALIDDATA; + } data += tile_size; size -= tile_size; } |