diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 00:48:15 +0100 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-05-15 12:13:53 +0300 |
| commit | 4162fc62b30d5b57910c17e46f2a9319a09cdae0 (patch) | |
| tree | e0b1e986b98ed70474759a188d3633a0bac50c79 | |
| parent | ec7d002e55590bf9e2c2745065ec3463364a5273 (diff) | |
vc1dec: Do not allow field_mode to change after the first header
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin@martin.st>
| -rw-r--r-- | libavcodec/vc1.c | 17 | ||||
| -rw-r--r-- | libavcodec/vc1.h | 1 | ||||
| -rw-r--r-- | libavcodec/vc1dec.c | 2 |
3 files changed, 14 insertions, 6 deletions
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c index 25e3579d5c..86651fecd8 100644 --- a/libavcodec/vc1.c +++ b/libavcodec/vc1.c @@ -825,6 +825,7 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) int status; int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */ int scale, shift, i; /* for initializing LUT for intensity compensation */ + int field_mode, fcm; v->p_frame_skipped = 0; if (v->second_field) { @@ -836,19 +837,23 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) goto parse_common_info; } - v->field_mode = 0; + field_mode = 0; if (v->interlace) { - v->fcm = decode012(gb); - if (v->fcm) { - if (v->fcm == ILACE_FIELD) - v->field_mode = 1; + fcm = decode012(gb); + if (fcm) { + if (fcm == ILACE_FIELD) + field_mode = 1; if (!v->warn_interlaced++) av_log(v->s.avctx, AV_LOG_ERROR, "Interlaced frames/fields support is incomplete\n"); } } else { - v->fcm = PROGRESSIVE; + fcm = PROGRESSIVE; } + if (!v->first_pic_header_flag && v->field_mode != field_mode) + return AVERROR_INVALIDDATA; + v->field_mode = field_mode; + v->fcm = fcm; if (v->field_mode) { v->fptype = get_bits(gb, 3); diff --git a/libavcodec/vc1.h b/libavcodec/vc1.h index 6f24c0e4af..88980d49a6 100644 --- a/libavcodec/vc1.h +++ b/libavcodec/vc1.h @@ -372,6 +372,7 @@ typedef struct VC1Context{ int qs_last; ///< if qpel has been used in the previous (tr.) picture int bmvtype; int frfd, brfd; ///< reference frame distance (forward or backward) + int first_pic_header_flag; int pic_header_flag; /** Frame decoding info for sprite modes */ diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 86806b1d21..7345d5322b 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5463,6 +5463,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, // do parse frame header v->pic_header_flag = 0; + v->first_pic_header_flag = 1; if (v->profile < PROFILE_ADVANCED) { if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { goto err; @@ -5472,6 +5473,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } } + v->first_pic_header_flag = 0; if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) && s->pict_type != AV_PICTURE_TYPE_I) { |