diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-10-02 21:02:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-10-03 11:55:23 +0200 |
| commit | 85c92789b60416bb89f7938fa236c558603559f6 (patch) | |
| tree | b3d47af2020c411cdb254b2269a078f10e93b3ef /libavcodec | |
| parent | 5fa5e73e81f191be0c4761bb4c517fdd39aff82e (diff) | |
| download | ffmpeg-85c92789b60416bb89f7938fa236c558603559f6.tar.gz | |
avcodec/h264_ps: Fix copying oversized pps&sps data
Fixes: https://trac.ffmpeg.org/attachment/ticket/685/movie.264
In the available testcase the actual PPS only uses a few bits
while there are 7kbyte of apparently random data after it
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/h264_ps.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index fd16a958ed..e37a6d62fa 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -312,8 +312,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation) return AVERROR(ENOMEM); sps->data_size = h->gb.buffer_end - h->gb.buffer; - if (sps->data_size > sizeof(sps->data)) - goto fail; + if (sps->data_size > sizeof(sps->data)) { + av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized SPS\n"); + sps->data_size = sizeof(sps->data); + } memcpy(sps->data, h->gb.buffer, sps->data_size); profile_idc = get_bits(&h->gb, 8); @@ -611,8 +613,8 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length) return AVERROR(ENOMEM); pps->data_size = h->gb.buffer_end - h->gb.buffer; if (pps->data_size > sizeof(pps->data)) { - ret = AVERROR_INVALIDDATA; - goto fail; + av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized PPS\n"); + pps->data_size = sizeof(pps->data); } memcpy(pps->data, h->gb.buffer, pps->data_size); pps->sps_id = get_ue_golomb_31(&h->gb); |