xaymar/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/h263dec: Check against previous dimensions instead of coded

Browse Source 
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-01-30 02:28:32 +01:00
parent e91a7c9ca6
commit fb358672d9
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/h263dec.c
+10 -4
View File
@@ -426,7 +426,9 @@ int ff_h263_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
MpegEncContext *s = avctx->priv_data;
int ret;
int slice_ret = 0;
AVFrame *pict = data;
int bak_width, bak_height;
/* no supplementary picture */
if (buf_size == 0) {
@@ -490,6 +492,9 @@ retry:
// we need the idct permutation for reading a custom matrix
ff_mpv_idct_init(s);
bak_width = s->width;
bak_height = s->height;
/* let's go :-) */
if (CONFIG_WMV2_DECODER && s->msmpeg4_version == 5) {
ret = ff_wmv2_decode_picture_header(s);
@@ -512,11 +517,12 @@ retry:
}
if (ret < 0 || ret == FRAME_SKIPPED) {
if ( s->width != avctx->coded_width
|| s->height != avctx->coded_height) {
if ( s->width != bak_width
|| s->height != bak_height) {
av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n");
s->width = avctx->coded_width;
s->height= avctx->coded_height;
s->width = bak_width;
s->height= bak_height;
}
}
if (ret == FRAME_SKIPPED)