eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-01-06 14:15:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

h264: reject mismatching luma/chroma bit depths during sps parsing

Browse Source 
There is no point in delaying the check and it avoids bugs with a
half-initialized context.

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov
2013-11-28 10:54:35 +01:00
committed by Reinhard Tartler
parent 7f33a24e82
commit c4033cd4eb
2 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/h264.c
View File

@@ -4076,12 +4076,6 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){
if(avctx->has_b_frames < 2)
avctx->has_b_frames= !s->low_delay;
if (h->sps.bit_depth_luma != h->sps.bit_depth_chroma) {
av_log_missing_feature(s->avctx,
"Different bit depth between chroma and luma", 1);
return AVERROR_PATCHWELCOME;
}
if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||
h->cur_chroma_format_idc != h->sps.chroma_format_idc) {
if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {

5
libavcodec/h264_ps.c
View File

@@ -349,6 +349,11 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
}
sps->bit_depth_luma = get_ue_golomb(&s->gb) + 8;
sps->bit_depth_chroma = get_ue_golomb(&s->gb) + 8;
if (sps->bit_depth_chroma != sps->bit_depth_luma) {
av_log_missing_feature(s->avctx,
"Different bit depth between chroma and luma", 1);
goto fail;
}
sps->transform_bypass = get_bits1(&s->gb);
decode_scaling_matrices(h, sps, NULL, 1, sps->scaling_matrix4, sps->scaling_matrix8);
}else{