generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

h264: check sps.log2_max_frame_num for validity

Browse Source 
Fixes infinite or long taking loop in frame num gap code in
the fuzzed sample bipbop234.ts_s223302.

CC: libav-stable@libav.org
This commit is contained in:
Janne Grunau
2012-11-25 12:56:04 +01:00
parent 8cc2fa1e5d
commit d7d6efe42b
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/h264_ps.c
View File

@@ -37,6 +37,9 @@
//#undef NDEBUG
#include <assert.h>
#define MAX_LOG2_MAX_FRAME_NUM (12 + 4)
#define MIN_LOG2_MAX_FRAME_NUM 4
static const AVRational pixel_aspect[17]={
{0, 1},
{1, 1},
@@ -301,7 +304,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
MpegEncContext * const s = &h->s;
int profile_idc, level_idc, constraint_set_flags = 0;
unsigned int sps_id;
int i;
int i, log2_max_frame_num_minus4;
SPS *sps;
profile_idc= get_bits(&s->gb, 8);
@@ -348,7 +351,16 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
sps->bit_depth_chroma = 8;
}
sps->log2_max_frame_num= get_ue_golomb(&s->gb) + 4;
log2_max_frame_num_minus4 = get_ue_golomb(&s->gb);
if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 ||
log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) {
av_log(h->s.avctx, AV_LOG_ERROR,
"log2_max_frame_num_minus4 out of range (0-12): %d\n",
log2_max_frame_num_minus4);
return AVERROR_INVALIDDATA;
}
sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4;
sps->poc_type= get_ue_golomb_31(&s->gb);
if(sps->poc_type == 0){ //FIXME #define