generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/dnxhddec: treat pix_fmt like width/height

Browse Source 
Fixes out of array accesses
Fixes: asan_heap-oob_22c9a39_16_015.mxf
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f3c0e0bf6f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2014-10-29 00:57:07 +01:00
parent 557e8bd589
commit 6352153811
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/dnxhddec.c
View File

@@ -36,6 +36,7 @@ typedef struct DNXHDContext {
GetBitContext gb;
int64_t cid; ///< compression id
unsigned int width, height;
enum AVPixelFormat pix_fmt;
unsigned int mb_width, mb_height;
uint32_t mb_scan_index[68]; /* max for 1080p */
int cur_field; ///< current interlaced field
@@ -133,7 +134,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
ctx->is_444 = 0;
if (buf[0x4] == 0x2) {
ctx->avctx->pix_fmt = AV_PIX_FMT_YUV444P10;
ctx->pix_fmt = AV_PIX_FMT_YUV444P10;
ctx->avctx->bits_per_raw_sample = 10;
if (ctx->bit_depth != 10) {
ff_dsputil_init(&ctx->dsp, ctx->avctx);
@@ -142,7 +143,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
}
ctx->is_444 = 1;
} else if (buf[0x21] & 0x40) {
ctx->avctx->pix_fmt = AV_PIX_FMT_YUV422P10;
ctx->pix_fmt = AV_PIX_FMT_YUV422P10;
ctx->avctx->bits_per_raw_sample = 10;
if (ctx->bit_depth != 10) {
ff_dsputil_init(&ctx->dsp, ctx->avctx);
@@ -150,7 +151,7 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
ctx->decode_dct_block = dnxhd_decode_dct_block_10;
}
} else {
ctx->avctx->pix_fmt = AV_PIX_FMT_YUV422P;
ctx->pix_fmt = AV_PIX_FMT_YUV422P;
ctx->avctx->bits_per_raw_sample = 8;
if (ctx->bit_depth != 8) {
ff_dsputil_init(&ctx->dsp, ctx->avctx);
@@ -432,7 +433,13 @@ static int dnxhd_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
avctx->width, avctx->height, ctx->width, ctx->height);
first_field = 1;
}
if (avctx->pix_fmt != AV_PIX_FMT_NONE && avctx->pix_fmt != ctx->pix_fmt) {
av_log(avctx, AV_LOG_WARNING, "pix_fmt changed: %s -> %s\n",
av_get_pix_fmt_name(avctx->pix_fmt), av_get_pix_fmt_name(ctx->pix_fmt));
first_field = 1;
}
avctx->pix_fmt = ctx->pix_fmt;
ret = ff_set_dimensions(avctx, ctx->width, ctx->height);
if (ret < 0)
return ret;