virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

mpeg4videodec: Check the width/height in mpeg4_decode_sprite_trajectory

Browse Source 
This avoids a potential division by zero.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
This commit is contained in:
Martin Storsjö 2013-09-16 20:40:13 +03:00
parent a92538b7c0
commit f875a732e3
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/mpeg4videodec.c
View File

@ -154,7 +154,7 @@ static inline int mpeg4_is_resync(MpegEncContext *s){
return 0; return 0;
} }
static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb) static int mpeg4_decode_sprite_trajectory(MpegEncContext *s, GetBitContext *gb)
{ {
int i; int i;
int a= 2<<s->sprite_warping_accuracy; int a= 2<<s->sprite_warping_accuracy;
@ -170,6 +170,9 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
int h= s->height; int h= s->height;
int min_ab; int min_ab;
if (w <= 0 || h <= 0)
return AVERROR_INVALIDDATA;
for(i=0; i<s->num_sprite_warping_points; i++){ for(i=0; i<s->num_sprite_warping_points; i++){
int length; int length;
int x=0, y=0; int x=0, y=0;
@ -342,6 +345,7 @@ static void mpeg4_decode_sprite_trajectory(MpegEncContext * s, GetBitContext *gb
} }
s->real_sprite_warping_points= s->num_sprite_warping_points; s->real_sprite_warping_points= s->num_sprite_warping_points;
} }
return 0;
} }
/** /**
@ -416,7 +420,8 @@ int ff_mpeg4_decode_video_packet_header(MpegEncContext *s)
skip_bits(&s->gb, 3); /* intra dc vlc threshold */ skip_bits(&s->gb, 3); /* intra dc vlc threshold */
//FIXME don't just ignore everything //FIXME don't just ignore everything
if(s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE){ if(s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE){
mpeg4_decode_sprite_trajectory(s, &s->gb); if (mpeg4_decode_sprite_trajectory(s, &s->gb) < 0)
return AVERROR_INVALIDDATA;
av_log(s->avctx, AV_LOG_ERROR, "untested\n"); av_log(s->avctx, AV_LOG_ERROR, "untested\n");
} }
@ -2031,7 +2036,8 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){
} }
if(s->pict_type == AV_PICTURE_TYPE_S && (s->vol_sprite_usage==STATIC_SPRITE || s->vol_sprite_usage==GMC_SPRITE)){ if(s->pict_type == AV_PICTURE_TYPE_S && (s->vol_sprite_usage==STATIC_SPRITE || s->vol_sprite_usage==GMC_SPRITE)){
mpeg4_decode_sprite_trajectory(s, gb); if (mpeg4_decode_sprite_trajectory(s, gb) < 0)
return AVERROR_INVALIDDATA;
if(s->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, "sprite_brightness_change not supported\n"); if(s->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, "sprite_brightness_change not supported\n");
if(s->vol_sprite_usage==STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, "static sprite not supported\n"); if(s->vol_sprite_usage==STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, "static sprite not supported\n");
} }