RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

h264_ps: check croping values 

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-04-30 23:48:53 +02:00
parent 7edb984dd0
commit c3bd306e78
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/h264_ps.c
View File

@ -463,6 +463,8 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
int crop_right = get_ue_golomb(&h->gb);
int crop_top = get_ue_golomb(&h->gb);
int crop_bottom = get_ue_golomb(&h->gb);
int width = 16 * sps->mb_width;
int height = 16 * sps->mb_height * (2 - sps->frame_mbs_only_flag);
if (h->avctx->flags2 & CODEC_FLAG2_IGNORE_CROP) {
av_log(h->avctx, AV_LOG_DEBUG, "discarding sps cropping, original "
@ -487,6 +489,17 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
crop_left);
}
if (crop_left > (unsigned)INT_MAX / 4 / step_x ||
crop_right > (unsigned)INT_MAX / 4 / step_x ||
crop_top > (unsigned)INT_MAX / 4 / step_y ||
crop_bottom> (unsigned)INT_MAX / 4 / step_y ||
(crop_left + crop_right ) * step_x >= width ||
(crop_top + crop_bottom) * step_y >= height
) {
av_log(h->avctx, AV_LOG_ERROR, "crop values invalid %d %d %d %d / %d %d\n", crop_left, crop_right, crop_top, crop_bottom, width, height);
goto fail;
}
sps->crop_left = crop_left * step_x;
sps->crop_right = crop_right * step_x;
sps->crop_top = crop_top * step_y;