RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

vp9: fix mt-related hang a parser infinite loop. 

Fixes trac ticket 3274.

Looked-at-by: ubitux
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Ronald S. Bultje 2014-01-10 21:38:38 -05:00 committed by Michael Niedermayer
parent 7dc0aba3fb
commit 0065d2d520
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/vp9.c
View File

@ -3592,11 +3592,15 @@ static int vp9_decode_frame(AVCodecContext *ctx, void *frame,
data += 4;
size -= 4;
}
if (tile_size > size)
if (tile_size > size) {
ff_thread_report_progress(&s->frames[CUR_FRAME].tf, INT_MAX, 0);
return AVERROR_INVALIDDATA;
}
ff_vp56_init_range_decoder(&s->c_b[tile_col], data, tile_size);
if (vp56_rac_get_prob_branchy(&s->c_b[tile_col], 128)) // marker bit
if (vp56_rac_get_prob_branchy(&s->c_b[tile_col], 128)) { // marker bit
ff_thread_report_progress(&s->frames[CUR_FRAME].tf, INT_MAX, 0);
return AVERROR_INVALIDDATA;
}
data += tile_size;
size -= tile_size;
}

2
libavcodec/vp9_parser.c
View File

@ -80,7 +80,7 @@ static int parse(AVCodecParserContext *ctx,
av_log(avctx, AV_LOG_ERROR, \
"Superframe packet size too big: %d > %d\n", \
sz, size); \
return AVERROR_INVALIDDATA; \
return size; \
} \
if (first) { \
first = 0; \