mirror of https://git.ffmpeg.org/ffmpeg.git
h264: Check gray scale CBP, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
27d39c225b
commit
8a03a60b4a
|
@ -2266,6 +2266,11 @@ decode_intra_mb:
|
|||
cbp = decode_cabac_mb_cbp_luma( h );
|
||||
if(decode_chroma)
|
||||
cbp |= decode_cabac_mb_cbp_chroma( h ) << 4;
|
||||
} else {
|
||||
if (!decode_chroma && cbp>15) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "gray chroma\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
}
|
||||
|
||||
h->cbp_table[mb_xy] = h->cbp = cbp;
|
||||
|
|
|
@ -1070,6 +1070,11 @@ decode_intra_mb:
|
|||
if(IS_INTRA4x4(mb_type)) cbp= golomb_to_intra4x4_cbp_gray[cbp];
|
||||
else cbp= golomb_to_inter_cbp_gray[cbp];
|
||||
}
|
||||
} else {
|
||||
if (!decode_chroma && cbp>15) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "gray chroma\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
}
|
||||
|
||||
if(dct8x8_allowed && (cbp&15) && !IS_INTRA(mb_type)){
|
||||
|
|
Loading…
Reference in New Issue