virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avformat/evc: add range checks to evcc_parse_sps and return proper error codes

Browse Source 
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer
2023-06-22 10:44:44 -03:00
parent 552879d621
commit 3d1199dff6
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavformat/evc.c
View File

@@ -88,17 +88,19 @@ static int evcc_parse_sps(const uint8_t *bs, int bs_size, EVCDecoderConfiguratio
{ {
GetBitContext gb; GetBitContext gb;
unsigned sps_seq_parameter_set_id; unsigned sps_seq_parameter_set_id;
int ret;
bs += EVC_NALU_HEADER_SIZE; bs += EVC_NALU_HEADER_SIZE;
bs_size -= EVC_NALU_HEADER_SIZE; bs_size -= EVC_NALU_HEADER_SIZE;
if (init_get_bits8(&gb, bs, bs_size) < 0) ret = init_get_bits8(&gb, bs, bs_size);
return 0; if (ret < 0)
return ret;
sps_seq_parameter_set_id = get_ue_golomb_31(&gb); sps_seq_parameter_set_id = get_ue_golomb_31(&gb);
if (sps_seq_parameter_set_id >= EVC_MAX_SPS_COUNT) if (sps_seq_parameter_set_id >= EVC_MAX_SPS_COUNT)
return 0; return AVERROR_INVALIDDATA;
// the Baseline profile is indicated by profile_idc eqal to 0 // the Baseline profile is indicated by profile_idc eqal to 0
// the Main profile is indicated by profile_idc eqal to 1 // the Main profile is indicated by profile_idc eqal to 1
@@ -114,12 +116,17 @@ static int evcc_parse_sps(const uint8_t *bs, int bs_size, EVCDecoderConfiguratio
// 2 - 4:2:2 // 2 - 4:2:2
// 3 - 4:4:4 // 3 - 4:4:4
evcc->chroma_format_idc = get_ue_golomb_31(&gb); evcc->chroma_format_idc = get_ue_golomb_31(&gb);
if (evcc->chroma_format_idc > 3)
return AVERROR_INVALIDDATA;
evcc->pic_width_in_luma_samples = get_ue_golomb_long(&gb); evcc->pic_width_in_luma_samples = get_ue_golomb_long(&gb);
evcc->pic_height_in_luma_samples = get_ue_golomb_long(&gb); evcc->pic_height_in_luma_samples = get_ue_golomb_long(&gb);
evcc->bit_depth_luma_minus8 = get_ue_golomb_31(&gb); evcc->bit_depth_luma_minus8 = get_ue_golomb_31(&gb);
evcc->bit_depth_chroma_minus8 = get_ue_golomb_31(&gb); evcc->bit_depth_chroma_minus8 = get_ue_golomb_31(&gb);
// EVCDecoderConfigurationRecord can't store values > 7. Limit it to bit depth 14.
if (evcc->bit_depth_luma_minus8 > 6 || evcc->bit_depth_chroma_minus8 > 6)
return AVERROR_INVALIDDATA;
return 0; return 0;
} }