ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-10-18 20:43:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

avformat/evc: add range checks to evcc_parse_sps and return proper error codes

Browse Source 
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2023-06-22 10:44:44 -03:00
parent 552879d621
commit 3d1199dff6
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavformat/evc.c
View File

@ -88,17 +88,19 @@ static int evcc_parse_sps(const uint8_t *bs, int bs_size, EVCDecoderConfiguratio
{
GetBitContext gb;
unsigned sps_seq_parameter_set_id;
int ret;
bs += EVC_NALU_HEADER_SIZE;
bs_size -= EVC_NALU_HEADER_SIZE;
if (init_get_bits8(&gb, bs, bs_size) < 0)
return 0;
ret = init_get_bits8(&gb, bs, bs_size);
if (ret < 0)
return ret;
sps_seq_parameter_set_id = get_ue_golomb_31(&gb);
if (sps_seq_parameter_set_id >= EVC_MAX_SPS_COUNT)
return 0;
return AVERROR_INVALIDDATA;
// the Baseline profile is indicated by profile_idc eqal to 0
// the Main profile is indicated by profile_idc eqal to 1
@ -114,12 +116,17 @@ static int evcc_parse_sps(const uint8_t *bs, int bs_size, EVCDecoderConfiguratio
// 2 - 4:2:2
// 3 - 4:4:4
evcc->chroma_format_idc = get_ue_golomb_31(&gb);
if (evcc->chroma_format_idc > 3)
return AVERROR_INVALIDDATA;
evcc->pic_width_in_luma_samples = get_ue_golomb_long(&gb);
evcc->pic_height_in_luma_samples = get_ue_golomb_long(&gb);
evcc->bit_depth_luma_minus8 = get_ue_golomb_31(&gb);
evcc->bit_depth_chroma_minus8 = get_ue_golomb_31(&gb);
// EVCDecoderConfigurationRecord can't store values > 7. Limit it to bit depth 14.
if (evcc->bit_depth_luma_minus8 > 6 || evcc->bit_depth_chroma_minus8 > 6)
return AVERROR_INVALIDDATA;
return 0;
}