mirror of
				https://github.com/nyanmisaka/ffmpeg-rockchip.git
				synced 2025-10-31 12:36:41 +08:00 
			
		
		
		
	mpeg4videodec: Check that cplx_estimation_* fits in the available space
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
		| @@ -2050,6 +2050,10 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){ | |||||||
|          if(s->pict_type == AV_PICTURE_TYPE_B) |          if(s->pict_type == AV_PICTURE_TYPE_B) | ||||||
|             skip_bits_long(gb, s->cplx_estimation_trash_b); |             skip_bits_long(gb, s->cplx_estimation_trash_b); | ||||||
|  |  | ||||||
|  |          if(get_bits_left(gb) < 3) { | ||||||
|  |              av_log(s->avctx, AV_LOG_ERROR, "Header truncated\n"); | ||||||
|  |              return -1; | ||||||
|  |          } | ||||||
|          s->intra_dc_threshold= ff_mpeg4_dc_threshold[ get_bits(gb, 3) ]; |          s->intra_dc_threshold= ff_mpeg4_dc_threshold[ get_bits(gb, 3) ]; | ||||||
|          if(!s->progressive_sequence){ |          if(!s->progressive_sequence){ | ||||||
|              s->top_field_first= get_bits1(gb); |              s->top_field_first= get_bits1(gb); | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user
	 Michael Niedermayer
					Michael Niedermayer