diff options
| author | Hendrik Leppkes <h.leppkes@gmail.com> | 2016-11-17 15:17:21 +0100 |
|---|---|---|
| committer | Hendrik Leppkes <h.leppkes@gmail.com> | 2016-11-17 15:17:21 +0100 |
| commit | cca4fd477851c3ab3b4ee7da525d5eb81bbe8de1 (patch) | |
| tree | a536226e750685bf4dc0c2b587ebe7a62edf61fd /libavcodec/h264_ps.c | |
| parent | 4c5c522fc1a55940e931ece665b2b249d8f39bb1 (diff) | |
| parent | a8cbe5a0ccebf60a8a8b0aba5d5716dd54c1595c (diff) | |
Merge commit 'a8cbe5a0ccebf60a8a8b0aba5d5716dd54c1595c'
* commit 'a8cbe5a0ccebf60a8a8b0aba5d5716dd54c1595c':
h264_ps: export actual height in MBs as SPS.mb_height
Merged-by: Hendrik Leppkes <h.leppkes@gmail.com>
Diffstat (limited to 'libavcodec/h264_ps.c')
| -rw-r--r-- | libavcodec/h264_ps.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 4a5f66e184..8218e3a010 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -467,15 +467,22 @@ int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx, sps->mb_height = get_ue_golomb(gb) + 1; sps->frame_mbs_only_flag = get_bits1(gb); + + if (sps->mb_height >= INT_MAX / 2) { + av_log(avctx, AV_LOG_ERROR, "height overflow\n"); + goto fail; + } + sps->mb_height *= 2 - sps->frame_mbs_only_flag; + if (!sps->frame_mbs_only_flag) sps->mb_aff = get_bits1(gb); else sps->mb_aff = 0; if ((unsigned)sps->mb_width >= INT_MAX / 16 || - (unsigned)sps->mb_height >= INT_MAX / (16 * (2 - sps->frame_mbs_only_flag)) || + (unsigned)sps->mb_height >= INT_MAX / 16 || av_image_check_size(16 * sps->mb_width, - 16 * sps->mb_height * (2 - sps->frame_mbs_only_flag), 0, avctx)) { + 16 * sps->mb_height, 0, avctx)) { av_log(avctx, AV_LOG_ERROR, "mb_width/height overflow\n"); goto fail; } @@ -494,7 +501,7 @@ int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx, unsigned int crop_top = get_ue_golomb(gb); unsigned int crop_bottom = get_ue_golomb(gb); int width = 16 * sps->mb_width; - int height = 16 * sps->mb_height * (2 - sps->frame_mbs_only_flag); + int height = 16 * sps->mb_height; if (avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) { av_log(avctx, AV_LOG_DEBUG, "discarding sps cropping, original " |