diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2022-07-03 13:31:19 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-10-21 22:19:37 +0200 |
| commit | 0f49789f7ccd31739e9d1cf157281c12e486916c (patch) | |
| tree | 78e4b55a57d23104e4baa1045d9c1325eb0cb0a5 /libavcodec | |
| parent | 3df3d2cfe7895c95e81a79ceaf8ef53bef6b3159 (diff) | |
| download | ffmpeg-0f49789f7ccd31739e9d1cf157281c12e486916c.tar.gz | |
avcodec/ffv1dec: Limit golomb rice coded slices to width 8M
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4431399ec1e10afff458cf1ffae2a75987d725a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/ffv1dec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index d43b8b91b5..191da8cb87 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -175,6 +175,9 @@ static int decode_slice_header(FFV1Context *f, FFV1Context *fs) || (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height) return -1; + if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23)) + return AVERROR_INVALIDDATA; + for (i = 0; i < f->plane_count; i++) { PlaneContext * const p = &fs->plane[i]; int idx = get_symbol(c, state, 0); |