virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-04-08 16:54:03 +02:00
Code Issues Releases Activity

mss2: only use error correction for matching block counts

Browse Source 
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 2566ad98b01538ea589e5ee07b69fc566aadc348)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2016-11-24 23:57:46 +01:00
parent 88bf1d2749
commit 0496403c08
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/mss2.c
View File

@ -422,7 +422,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size,
ff_vc1_decode_blocks(v); ff_vc1_decode_blocks(v);
ff_er_frame_end(&s->er); if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) {
ff_er_frame_end(&s->er);
} else {
av_log(v->s.avctx, AV_LOG_WARNING,
"disabling error correction due to block count mismatch %dx%d != %dx%d\n",
v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height);
}
ff_mpv_frame_end(s); ff_mpv_frame_end(s);