From 4162fc62b30d5b57910c17e46f2a9319a09cdae0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Nov 2012 00:48:15 +0100 Subject: vc1dec: Do not allow field_mode to change after the first header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes out of array accesses. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Martin Storsjö --- libavcodec/vc1.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'libavcodec/vc1.c') diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c index 25e3579d5c..86651fecd8 100644 --- a/libavcodec/vc1.c +++ b/libavcodec/vc1.c @@ -825,6 +825,7 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) int status; int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */ int scale, shift, i; /* for initializing LUT for intensity compensation */ + int field_mode, fcm; v->p_frame_skipped = 0; if (v->second_field) { @@ -836,19 +837,23 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) goto parse_common_info; } - v->field_mode = 0; + field_mode = 0; if (v->interlace) { - v->fcm = decode012(gb); - if (v->fcm) { - if (v->fcm == ILACE_FIELD) - v->field_mode = 1; + fcm = decode012(gb); + if (fcm) { + if (fcm == ILACE_FIELD) + field_mode = 1; if (!v->warn_interlaced++) av_log(v->s.avctx, AV_LOG_ERROR, "Interlaced frames/fields support is incomplete\n"); } } else { - v->fcm = PROGRESSIVE; + fcm = PROGRESSIVE; } + if (!v->first_pic_header_flag && v->field_mode != field_mode) + return AVERROR_INVALIDDATA; + v->field_mode = field_mode; + v->fcm = fcm; if (v->field_mode) { v->fptype = get_bits(gb, 3); -- cgit v1.2.3