| Message ID | 3e6e633e94641a8f4cf2c892576cb38a6d8854b1.1730860181.git.pross@xvid.org |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/2] avcodec/rv60: negative qp guard | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
Fixes ticket #11289 (crash).
---
continuation of patch set: https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2024-November/335675.html
libavcodec/rv60dec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 86c7aefbca..8ec95e896f 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -2355,6 +2355,8 @@ static int rv60_decode_frame(AVCodecContext *avctx, AVFrame * frame,
ofs = get_bits_count(&gb) / 8;
for (int i = 0; i < s->cu_height; i++) {
+ if (header_size + ofs >= avpkt->size)
+ return AVERROR_INVALIDDATA;
s->slice[i].data = avpkt->data + header_size + ofs;
s->slice[i].data_size = FFMIN(s->slice[i].size, avpkt->size - header_size - ofs);
ofs += s->slice[i].size;
Fixes ticket #11289 (deadlock).
---
continuation of patch set: https://lists.ffmpeg.org/pipermail/ffmpeg-devel/2024-November/335675.html
libavcodec/rv60dec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c
index 8ec95e896f..0ce346fefb 100644
--- a/libavcodec/rv60dec.c
+++ b/libavcodec/rv60dec.c
@@ -2271,15 +2271,17 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
ff_thread_progress_await(&s->progress[cu_y - 1], cu_x + 2);
qp = s->qp + read_qp_offset(&gb, s->qp_off_type);
- if (qp < 0)
- return AVERROR_INVALIDDATA;
+ if (qp < 0) {
+ ret = AVERROR_INVALIDDATA;
+ break;
+ }
sel_qp = calc_sel_qp(s->osvquant, qp);
memset(thread.coded_blk, 0, sizeof(thread.coded_blk));
thread.cu_split_pos = 0;
if ((ret = decode_cu_r(s, frame, &thread, &gb, cu_x << 6, cu_y << 6, 6, qp, sel_qp)) < 0)
- return ret;
+ break;
if (s->deblock) {
thread.cu_split_pos = 0;
@@ -2293,7 +2295,7 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread
if (s->avctx->active_thread_type & FF_THREAD_SLICE)
ff_thread_progress_report(&s->progress[cu_y], INT_MAX);
- return 0;
+ return ret;
}
static int rv60_decode_frame(AVCodecContext *avctx, AVFrame * frame,
diff --git a/libavcodec/rv60dec.c b/libavcodec/rv60dec.c index d68fa66fa7..86c7aefbca 100644 --- a/libavcodec/rv60dec.c +++ b/libavcodec/rv60dec.c @@ -2263,7 +2263,8 @@ static int decode_slice(AVCodecContext *avctx, void *tdata, int cu_y, int thread thread.avg_linesize[1] = 32; thread.avg_linesize[2] = 32; - init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size); + if ((ret = init_get_bits8(&gb, s->slice[cu_y].data, s->slice[cu_y].size)) < 0) + return ret; for (int cu_x = 0; cu_x < s->cu_width; cu_x++) { if ((s->avctx->active_thread_type & FF_THREAD_SLICE) && cu_y) @@ -2317,7 +2318,8 @@ static int rv60_decode_frame(AVCodecContext *avctx, AVFrame * frame, if (avpkt->size < header_size) return AVERROR_INVALIDDATA; - init_get_bits8(&gb, avpkt->data + header_size, avpkt->size - header_size); + if ((ret = init_get_bits8(&gb, avpkt->data + header_size, avpkt->size - header_size)) < 0) + return ret; if ((ret = read_frame_header(s, &gb, &width, &height)) < 0) return ret;