highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

h264: check sps.log2_max_frame_num for validity

Browse Source 
Fixes infinite or long taking loop in frame num gap code in
the fuzzed sample bipbop234.ts_s223302.

CC: libav-stable@libav.org
(cherry picked from commit d7d6efe42b0d2057e67999b96b9a391f533d2333)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Janne Grunau 2012-11-25 12:56:04 +01:00 committed by Reinhard Tartler
parent 08d9fd611e
commit 4457e6137d
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/h264_ps.c
View File

@ -37,6 +37,9 @@
//#undef NDEBUG
#include <assert.h>
#define MAX_LOG2_MAX_FRAME_NUM (12 + 4)
#define MIN_LOG2_MAX_FRAME_NUM 4
static const AVRational pixel_aspect[17]={
{0, 1},
{1, 1},
@ -298,7 +301,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
MpegEncContext * const s = &h->s;
int profile_idc, level_idc, constraint_set_flags = 0;
unsigned int sps_id;
int i;
int i, log2_max_frame_num_minus4;
SPS *sps;
profile_idc= get_bits(&s->gb, 8);
@ -345,7 +348,16 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
sps->bit_depth_chroma = 8;
}
sps->log2_max_frame_num= get_ue_golomb(&s->gb) + 4;
log2_max_frame_num_minus4 = get_ue_golomb(&s->gb);
if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 ||
log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) {
av_log(h->s.avctx, AV_LOG_ERROR,
"log2_max_frame_num_minus4 out of range (0-12): %d\n",
log2_max_frame_num_minus4);
return AVERROR_INVALIDDATA;
}
sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4;
sps->poc_type= get_ue_golomb_31(&s->gb);
if(sps->poc_type == 0){ //FIXME #define