diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-30 23:48:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-04-30 23:48:53 +0200 |
| commit | c3bd306e78f9e3ca2f136f5b30cbe49fa0884f82 (patch) | |
| tree | 4f21cef2cf5ad67110b437ad7cfe41408db8f49a | |
| parent | 7edb984dd051b6919d7d8471c70499273f31b0fa (diff) | |
h264_ps: check croping values
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264_ps.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 68f504a360..6172fdd45a 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -463,6 +463,8 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ int crop_right = get_ue_golomb(&h->gb); int crop_top = get_ue_golomb(&h->gb); int crop_bottom = get_ue_golomb(&h->gb); + int width = 16 * sps->mb_width; + int height = 16 * sps->mb_height * (2 - sps->frame_mbs_only_flag); if (h->avctx->flags2 & CODEC_FLAG2_IGNORE_CROP) { av_log(h->avctx, AV_LOG_DEBUG, "discarding sps cropping, original " @@ -487,6 +489,17 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ crop_left); } + if (crop_left > (unsigned)INT_MAX / 4 / step_x || + crop_right > (unsigned)INT_MAX / 4 / step_x || + crop_top > (unsigned)INT_MAX / 4 / step_y || + crop_bottom> (unsigned)INT_MAX / 4 / step_y || + (crop_left + crop_right ) * step_x >= width || + (crop_top + crop_bottom) * step_y >= height + ) { + av_log(h->avctx, AV_LOG_ERROR, "crop values invalid %d %d %d %d / %d %d\n", crop_left, crop_right, crop_top, crop_bottom, width, height); + goto fail; + } + sps->crop_left = crop_left * step_x; sps->crop_right = crop_right * step_x; sps->crop_top = crop_top * step_y; |