highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/dnxhddec: Move mb height check out of non hr branch

Browse Source 
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 296debd213bd6dce7647cedd34eb64e5b94cdc92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-07-26 03:26:59 +02:00
parent 7f3124e08c
commit 956f2db21f
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/dnxhddec.c
View File

@ -273,14 +273,18 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
if (header_prefix == DNXHD_HEADER_HR2) { if (header_prefix == DNXHD_HEADER_HR2) {
ctx->data_offset = 0x170 + (ctx->mb_height << 2); ctx->data_offset = 0x170 + (ctx->mb_height << 2);
} else { } else {
if (ctx->mb_height > 68 || if (ctx->mb_height > 68) {
(ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
av_log(ctx->avctx, AV_LOG_ERROR, av_log(ctx->avctx, AV_LOG_ERROR,
"mb height too big: %d\n", ctx->mb_height); "mb height too big: %d\n", ctx->mb_height);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
ctx->data_offset = 0x280; ctx->data_offset = 0x280;
} }
if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
av_log(ctx->avctx, AV_LOG_ERROR,
"mb height too big: %d\n", ctx->mb_height);
return AVERROR_INVALIDDATA;
}
if (buf_size < ctx->data_offset) { if (buf_size < ctx->data_offset) {
av_log(ctx->avctx, AV_LOG_ERROR, av_log(ctx->avctx, AV_LOG_ERROR,