RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-03-01 10:11:01 +00:00
Code Issues Projects Releases Wiki Activity

diracdec: check that block length is valid

Browse Source 
In init_planes p->xblen and p->yblen are set to:
            p->xblen = s->plane[0].xblen >> s->chroma_x_shift;
            p->yblen = s->plane[0].yblen >> s->chroma_y_shift;

These are later used as block_w and block_h arguments of
s->vdsp.emulated_edge_mc. If one of them is 0 it triggers an av_assert2
in emulated_edge_mc:
    av_assert2(start_x < end_x && block_w > 0);
    av_assert2(start_y < end_y && block_h > 0);

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 75fc81c831)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Andreas Cadhalpun 2015-05-06 15:34:53 +02:00 committed by Michael Niedermayer
parent 8c8a9a20cf
commit f61ebd555d
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/diracdec.c
View File

@ -896,6 +896,14 @@ static int dirac_unpack_prediction_parameters(DiracContext *s)
/*[DIRAC_STD] 11.2.4 motion_data_dimensions() /*[DIRAC_STD] 11.2.4 motion_data_dimensions()
Calculated in function dirac_unpack_block_motion_data */ Calculated in function dirac_unpack_block_motion_data */
if (s->plane[0].xblen % (1 << s->chroma_x_shift) != 0 ||
s->plane[0].yblen % (1 << s->chroma_y_shift) != 0 ||
!s->plane[0].xblen || !s->plane[0].yblen) {
av_log(s->avctx, AV_LOG_ERROR,
"invalid x/y block length (%d/%d) for x/y chroma shift (%d/%d)\n",
s->plane[0].xblen, s->plane[0].yblen, s->chroma_x_shift, s->chroma_y_shift);
return AVERROR_INVALIDDATA;
}
if (!s->plane[0].xbsep || !s->plane[0].ybsep || s->plane[0].xbsep < s->plane[0].xblen/2 || s->plane[0].ybsep < s->plane[0].yblen/2) { if (!s->plane[0].xbsep || !s->plane[0].ybsep || s->plane[0].xbsep < s->plane[0].xblen/2 || s->plane[0].ybsep < s->plane[0].yblen/2) {
av_log(s->avctx, AV_LOG_ERROR, "Block separation too small\n"); av_log(s->avctx, AV_LOG_ERROR, "Block separation too small\n");
return -1; return -1;