virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/h263dec: Check against previous dimensions instead of coded

Browse Source 
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-01-30 02:28:32 +01:00
parent d845533130
commit 0fe33c99a2
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/h263dec.c
View File

@@ -431,6 +431,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict,
MpegEncContext *s = avctx->priv_data; MpegEncContext *s = avctx->priv_data;
int ret; int ret;
int slice_ret = 0; int slice_ret = 0;
int bak_width, bak_height;
/* no supplementary picture */ /* no supplementary picture */
if (buf_size == 0) { if (buf_size == 0) {
@@ -482,6 +483,9 @@ retry:
if (ret < 0) if (ret < 0)
return ret; return ret;
bak_width = s->width;
bak_height = s->height;
/* let's go :-) */ /* let's go :-) */
if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) { if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) {
ret = ff_wmv2_decode_picture_header(s); ret = ff_wmv2_decode_picture_header(s);
@@ -501,11 +505,12 @@ retry:
} }
if (ret < 0 || ret == FRAME_SKIPPED) { if (ret < 0 || ret == FRAME_SKIPPED) {
if ( s->width != avctx->coded_width if ( s->width != bak_width
|| s->height != avctx->coded_height) { || s->height != bak_height) {
av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n"); av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n");
s->width = avctx->coded_width; s->width = bak_width;
s->height= avctx->coded_height; s->height= bak_height;
} }
} }
if (ret == FRAME_SKIPPED) if (ret == FRAME_SKIPPED)