From 4aa0de644a2de62f0bc3013a4533ab9283aa0a65 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 30 Jun 2015 03:23:30 +0200 Subject: avcodec/h264_refs: discard mismatching references Fixes inconsistency and out of array access Fixes: asan_heap-oob_17301a3_2100_cov_3226131691_ff_add_pixels_clamped_mmx.m2ts Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/h264_refs.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'libavcodec/h264_refs.c') diff --git a/libavcodec/h264_refs.c b/libavcodec/h264_refs.c index 0d8fa8bf19..ac6f6bf59c 100644 --- a/libavcodec/h264_refs.c +++ b/libavcodec/h264_refs.c @@ -125,6 +125,7 @@ static int add_sorted(H264Picture **sorted, H264Picture **src, int len, int limi int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl) { int i, len; + int j; if (sl->slice_type_nos == AV_PICTURE_TYPE_B) { H264Picture *sorted[32]; @@ -188,6 +189,21 @@ int ff_h264_fill_default_ref_list(H264Context *h, H264SliceContext *sl) } } #endif + + for (j = 0; j<1+(sl->slice_type_nos == AV_PICTURE_TYPE_B); j++) { + for (i = 0; i < sl->ref_count[j]; i++) { + if (h->default_ref_list[j][i].parent) { + AVFrame *f = h->default_ref_list[j][i].parent->f; + if (h->cur_pic_ptr->f->width != f->width || + h->cur_pic_ptr->f->height != f->height || + h->cur_pic_ptr->f->format != f->format) { + av_log(h->avctx, AV_LOG_ERROR, "Discarding mismatching reference\n"); + memset(&h->default_ref_list[j][i], 0, sizeof(h->default_ref_list[j][i])); + } + } + } + } + return 0; } -- cgit v1.2.3