diff options
| author | wm4 <nfxjfg@googlemail.com> | 2015-10-02 17:18:00 +0200 |
|---|---|---|
| committer | wm4 <nfxjfg@googlemail.com> | 2015-10-02 19:08:54 +0200 |
| commit | 069190f7078e1e3abbfa27e2d97a10f33ae05fef (patch) | |
| tree | e31b96457e901d132ba292fba0bcedfc8587b5e0 /libavcodec/h264_ps.c | |
| parent | 74ef5449a6fb64f4c4be4bfd470dc17de5ecb561 (diff) | |
avcodec/h264: keep SPS and PPS bitstream data
We assume an upper bound of 4096 bytes for each raw SPS/PPS. It's hard
to determine an exact maximum size, but this value was was considered
high enough and safe.
Needed for the following VideotoolBox commit.
Diffstat (limited to 'libavcodec/h264_ps.c')
| -rw-r--r-- | libavcodec/h264_ps.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 52d235cbaa..fd16a958ed 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -307,6 +307,15 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation) int i, log2_max_frame_num_minus4; SPS *sps; + sps = av_mallocz(sizeof(SPS)); + if (!sps) + return AVERROR(ENOMEM); + + sps->data_size = h->gb.buffer_end - h->gb.buffer; + if (sps->data_size > sizeof(sps->data)) + goto fail; + memcpy(sps->data, h->gb.buffer, sps->data_size); + profile_idc = get_bits(&h->gb, 8); constraint_set_flags |= get_bits1(&h->gb) << 0; // constraint_set0_flag constraint_set_flags |= get_bits1(&h->gb) << 1; // constraint_set1_flag @@ -320,11 +329,8 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation) if (sps_id >= MAX_SPS_COUNT) { av_log(h->avctx, AV_LOG_ERROR, "sps_id %u out of range\n", sps_id); - return AVERROR_INVALIDDATA; + goto fail; } - sps = av_mallocz(sizeof(SPS)); - if (!sps) - return AVERROR(ENOMEM); sps->sps_id = sps_id; sps->time_offset_length = 24; @@ -603,6 +609,12 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length) pps = av_mallocz(sizeof(PPS)); if (!pps) return AVERROR(ENOMEM); + pps->data_size = h->gb.buffer_end - h->gb.buffer; + if (pps->data_size > sizeof(pps->data)) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + memcpy(pps->data, h->gb.buffer, pps->data_size); pps->sps_id = get_ue_golomb_31(&h->gb); if ((unsigned)pps->sps_id >= MAX_SPS_COUNT || !h->sps_buffers[pps->sps_id]) { |