highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/ffv1dec: Limit golomb rice coded slices to width 8M

Browse Source 
This limit is possibly not reachable due to other restrictions on buffers but
the decoder run table is too small beyond this, so explicitly check for it.

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b4431399ec)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2022-07-03 13:31:19 +02:00
parent b5fc01adbe
commit 89685f280a
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/ffv1dec.c
View File

@ -185,6 +185,9 @@ static int decode_slice_header(const FFV1Context *f, FFV1Context *fs)
|| (unsigned)fs->slice_y + (uint64_t)fs->slice_height > f->height)
return -1;
if (fs->ac == AC_GOLOMB_RICE && fs->slice_width >= (1<<23))
return AVERROR_INVALIDDATA;
for (i = 0; i < f->plane_count; i++) {
PlaneContext * const p = &fs->plane[i];
int idx = get_symbol(c, state, 0);