virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

diracdec: check dimensions against chroma format.

Browse Source 
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-12-07 04:25:17 +01:00
parent f5d6b0c9c2
commit ea6da80cb4
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/dirac.c
View File

@ -119,6 +119,7 @@ static int parse_source_parameters(AVCodecContext *avctx, GetBitContext *gb,
AVRational frame_rate = {0,0}; AVRational frame_rate = {0,0};
unsigned luma_depth = 8, luma_offset = 16; unsigned luma_depth = 8, luma_offset = 16;
int idx; int idx;
int chroma_x_shift, chroma_y_shift;
/* [DIRAC_STD] 10.3.2 Frame size. frame_size(video_params) */ /* [DIRAC_STD] 10.3.2 Frame size. frame_size(video_params) */
/* [DIRAC_STD] custom_dimensions_flag */ /* [DIRAC_STD] custom_dimensions_flag */
@ -235,6 +236,12 @@ static int parse_source_parameters(AVCodecContext *avctx, GetBitContext *gb,
av_log(avctx, AV_LOG_WARNING, "Bitdepth greater than 8\n"); av_log(avctx, AV_LOG_WARNING, "Bitdepth greater than 8\n");
avctx->pix_fmt = dirac_pix_fmt[!luma_offset][source->chroma_format]; avctx->pix_fmt = dirac_pix_fmt[!luma_offset][source->chroma_format];
avcodec_get_chroma_sub_sample(avctx->pix_fmt, &chroma_x_shift, &chroma_y_shift);
if (!(source->width % (1<<chroma_x_shift)) || !(source->height % (1<<chroma_y_shift))) {
av_log(avctx, AV_LOG_ERROR, "Dimensions must be a integer multiply of the chroma subsampling\n");
return AVERROR_INVALIDDATA;
}
/* [DIRAC_STD] 10.3.9 Colour specification. colour_spec(video_params) */ /* [DIRAC_STD] 10.3.9 Colour specification. colour_spec(video_params) */
if (get_bits1(gb)) { /* [DIRAC_STD] custom_colour_spec_flag */ if (get_bits1(gb)) { /* [DIRAC_STD] custom_colour_spec_flag */