generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/ffv1: seperate slice_count from max_slice_count

Browse Source 
Fix segfault with too large slice_count
Fixes Ticket4879

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa6c43f3fd)

Conflicts:
	libavcodec/ffv1enc.c
	libavcodec/ffv1.c
This commit is contained in:
Michael Niedermayer
2015-09-24 23:49:30 +02:00
committed by Carl Eugen Hoyos
parent b0b37e018b
commit ef6d6f8906
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/ffv1dec.c
View File

@@ -770,6 +770,7 @@ static int read_header(FFV1Context *f)
av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n");
return AVERROR_INVALIDDATA;
}
f->slice_count = f->max_slice_count;
} else if (f->version < 3) {
f->slice_count = get_symbol(c, state, 0);
} else {
@@ -784,8 +785,8 @@ static int read_header(FFV1Context *f)
p -= size + trailer;
}
}
if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0) {
av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid\n", f->slice_count);
if (f->slice_count > (unsigned)MAX_SLICES || f->slice_count <= 0 || f->slice_count > f->max_slice_count) {
av_log(f->avctx, AV_LOG_ERROR, "slice count %d is invalid (max=%d)\n", f->slice_count, f->max_slice_count);
return AVERROR_INVALIDDATA;
}
@@ -1008,6 +1009,7 @@ static int init_thread_copy(AVCodecContext *avctx)
f->picture.f = NULL;
f->last_picture.f = NULL;
f->sample_buffer = NULL;
f->max_slice_count = 0;
f->slice_count = 0;
for (i = 0; i < f->quant_table_count; i++) {
@@ -1083,7 +1085,7 @@ static int update_thread_context(AVCodecContext *dst, const AVCodecContext *src)
av_assert0(!fdst->sample_buffer);
}
av_assert1(fdst->slice_count == fsrc->slice_count);
av_assert1(fdst->max_slice_count == fsrc->max_slice_count);
ff_thread_release_buffer(dst, &fdst->picture);