diff options
| author | Thomas Devanneaux <thomdev@gmail.com> | 2010-05-21 18:03:57 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-05-21 18:03:57 +0000 |
| commit | b50601e882a8b77d0c6367bc789afd00695fa1ac (patch) | |
| tree | c77aae5c40b86e3cc5d343e5d0821ab1f9c5db4d /libavcodec | |
| parent | d1026ab5063a3e4ed2259ea68ab6d6f2ecfb4435 (diff) | |
Check NAL unit size to avoid reading past the buffer.
This fixes issue1907
Patch by Thomas Devanneaux gmail(thomdev)
backport r23078 by benoit
Originally committed as revision 23211 to svn://svn.ffmpeg.org/ffmpeg/branches/0.6
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/h264_mp4toannexb_bsf.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavcodec/h264_mp4toannexb_bsf.c b/libavcodec/h264_mp4toannexb_bsf.c index 936418a8a0..0c92b36f65 100644 --- a/libavcodec/h264_mp4toannexb_bsf.c +++ b/libavcodec/h264_mp4toannexb_bsf.c @@ -55,7 +55,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc, int keyframe) { H264BSFContext *ctx = bsfc->priv_data; uint8_t unit_type; - uint32_t nal_size, cumul_size = 0; + int32_t nal_size; + uint32_t cumul_size = 0; + const uint8_t *buf_end = buf + buf_size; /* nothing to filter */ if (!avctx->extradata || avctx->extradata_size < 6) { @@ -109,6 +111,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc, *poutbuf_size = 0; *poutbuf = NULL; do { + if (buf + ctx->length_size > buf_end) + goto fail; + if (ctx->length_size == 1) nal_size = buf[0]; else if (ctx->length_size == 2) @@ -119,6 +124,9 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc, buf += ctx->length_size; unit_type = *buf & 0x1f; + if (buf + nal_size > buf_end || nal_size < 0) + goto fail; + /* prepend only to the first type 5 NAL unit of an IDR picture */ if (ctx->first_idr && unit_type == 5) { alloc_and_copy(poutbuf, poutbuf_size, @@ -139,6 +147,11 @@ static int h264_mp4toannexb_filter(AVBitStreamFilterContext *bsfc, } while (cumul_size < buf_size); return 1; + +fail: + av_freep(poutbuf); + *poutbuf_size = 0; + return AVERROR(EINVAL); } static void h264_mp4toannexb_close(AVBitStreamFilterContext *bsfc) |