mirror of https://git.ffmpeg.org/ffmpeg.git
theora: check that pix fmt is valid, fix null ptr deref
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
9eef41b848
commit
d1493d2ce5
|
@ -2175,6 +2175,10 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
|
||||||
{
|
{
|
||||||
skip_bits(gb, 5); /* keyframe frequency force */
|
skip_bits(gb, 5); /* keyframe frequency force */
|
||||||
avctx->pix_fmt = theora_pix_fmts[get_bits(gb, 2)];
|
avctx->pix_fmt = theora_pix_fmts[get_bits(gb, 2)];
|
||||||
|
if (avctx->pix_fmt == AV_PIX_FMT_NONE) {
|
||||||
|
av_log(avctx, AV_LOG_ERROR, "Invalid pixel format\n");
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
skip_bits(gb, 3); /* reserved */
|
skip_bits(gb, 3); /* reserved */
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2349,7 +2353,8 @@ static av_cold int theora_decode_init(AVCodecContext *avctx)
|
||||||
switch(ptype)
|
switch(ptype)
|
||||||
{
|
{
|
||||||
case 0x80:
|
case 0x80:
|
||||||
theora_decode_header(avctx, &gb);
|
if (theora_decode_header(avctx, &gb) < 0)
|
||||||
|
return -1;
|
||||||
break;
|
break;
|
||||||
case 0x81:
|
case 0x81:
|
||||||
// FIXME: is this needed? it breaks sometimes
|
// FIXME: is this needed? it breaks sometimes
|
||||||
|
|
Loading…
Reference in New Issue