ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/h264: Be more strict on rejecting pps/sps changes

Browse Source 
Fixes race condition
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6fafc62b0b)

Conflicts:

	libavcodec/h264.c
This commit is contained in:
Michael Niedermayer 2015-02-06 15:09:54 +01:00
parent 17ecc8a771
commit 01e2e746ba
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/h264.c
View File

@ -3424,6 +3424,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
int must_reinit;
int needs_reinit = 0;
int field_pic_flag, bottom_field_flag;
int first_slice = h == h0 && !h0->current_slice;
PPS *pps;
h->me.qpel_put = h->h264qpel.put_h264_qpel_pixels_tab;
h->me.qpel_avg = h->h264qpel.avg_h264_qpel_pixels_tab;
@ -3482,17 +3484,26 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
h0->au_pps_id, pps_id);
return AVERROR_INVALIDDATA;
}
h->pps = *h0->pps_buffers[pps_id];
if (!h0->sps_buffers[h->pps.sps_id]) {
pps = h0->pps_buffers[pps_id];
if (!h0->sps_buffers[pps->sps_id]) {
av_log(h->avctx, AV_LOG_ERROR,
"non-existing SPS %u referenced\n",
h->pps.sps_id);
return AVERROR_INVALIDDATA;
}
if (first_slice)
h->pps = *h0->pps_buffers[pps_id];
if (h->pps.sps_id != h->current_sps_id ||
h0->sps_buffers[h->pps.sps_id]->new) {
if (pps->sps_id != h->current_sps_id ||
h0->sps_buffers[pps->sps_id]->new) {
if (!first_slice) {
av_log(h->avctx, AV_LOG_ERROR,
"SPS changed in the middle of the frame\n");
return AVERROR_INVALIDDATA;
}
h->sps = *h0->sps_buffers[h->pps.sps_id];