Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-10-19 09:53:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

avcodec/h263dec: Check against previous dimensions instead of coded

Browse source 
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2025-01-30 02:28:32 +01:00
parent 9dea077922
commit c74740fcd5
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
libavcodec/h263dec.c
View file

@ -431,6 +431,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict,
MpegEncContext *s = avctx->priv_data;
int ret;
int slice_ret = 0;
int bak_width, bak_height;
/* no supplementary picture */
if (buf_size == 0) {
@ -482,6 +483,9 @@ retry:
if (ret < 0)
return ret;
bak_width = s->width;
bak_height = s->height;
/* let's go :-) */
if (CONFIG_WMV2_DECODER && s->msmpeg4_version == MSMP4_WMV2) {
ret = ff_wmv2_decode_picture_header(s);
@ -501,11 +505,12 @@ retry:
}
if (ret < 0 || ret == FRAME_SKIPPED) {
if ( s->width != avctx->coded_width
|| s->height != avctx->coded_height) {
if ( s->width != bak_width
|| s->height != bak_height) {
av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n");
s->width = avctx->coded_width;
s->height= avctx->coded_height;
s->width = bak_width;
s->height= bak_height;
}
}
if (ret == FRAME_SKIPPED)