RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/h264_ps: Fix copying oversized pps&sps data 

Fixes: https://trac.ffmpeg.org/attachment/ticket/685/movie.264

In the available testcase the actual PPS only uses a few bits
while there are 7kbyte of apparently random data after it

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-10-02 21:02:08 +02:00
parent 5fa5e73e81
commit 85c92789b6
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/h264_ps.c
View File

@ -312,8 +312,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
sps->data_size = h->gb.buffer_end - h->gb.buffer; sps->data_size = h->gb.buffer_end - h->gb.buffer;
if (sps->data_size > sizeof(sps->data)) if (sps->data_size > sizeof(sps->data)) {
goto fail; av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized SPS\n");
sps->data_size = sizeof(sps->data);
}
memcpy(sps->data, h->gb.buffer, sps->data_size); memcpy(sps->data, h->gb.buffer, sps->data_size);
profile_idc = get_bits(&h->gb, 8); profile_idc = get_bits(&h->gb, 8);
@ -611,8 +613,8 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
pps->data_size = h->gb.buffer_end - h->gb.buffer; pps->data_size = h->gb.buffer_end - h->gb.buffer;
if (pps->data_size > sizeof(pps->data)) { if (pps->data_size > sizeof(pps->data)) {
ret = AVERROR_INVALIDDATA; av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized PPS\n");
goto fail; pps->data_size = sizeof(pps->data);
} }
memcpy(pps->data, h->gb.buffer, pps->data_size); memcpy(pps->data, h->gb.buffer, pps->data_size);
pps->sps_id = get_ue_golomb_31(&h->gb); pps->sps_id = get_ue_golomb_31(&h->gb);