diff mbox

[FFmpeg-devel] avcodec/dnxhddec: Move mb height check out of non hr branch

Message ID 20170726012659.3680-1-michael@niedermayer.cc
State Accepted
Commit 296debd213bd6dce7647cedd34eb64e5b94cdc92
Headers show

Commit Message

Michael Niedermayer July 26, 2017, 1:26 a.m. UTC 
Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu@VARAS of IIE
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/dnxhddec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Michael Niedermayer July 27, 2017, 1:07 a.m. UTC | #1 
On Wed, Jul 26, 2017 at 03:26:59AM +0200, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: poc.dnxhd
> 
> Found-by: Bingchang, Liu@VARAS of IIE
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/dnxhddec.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)

applied

[...]
diff mbox

Patch

diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index 40d41f9bf1..f46e41a456 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -298,14 +298,18 @@  static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
     if (ctx->mb_height > 68 && ff_dnxhd_check_header_prefix_hr(header_prefix)) {
         ctx->data_offset = 0x170 + (ctx->mb_height << 2);
     } else {
-        if (ctx->mb_height > 68 ||
-            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        if (ctx->mb_height > 68) {
             av_log(ctx->avctx, AV_LOG_ERROR,
                    "mb height too big: %d\n", ctx->mb_height);
             return AVERROR_INVALIDDATA;
         }
         ctx->data_offset = 0x280;
     }
+    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        av_log(ctx->avctx, AV_LOG_ERROR,
+                "mb height too big: %d\n", ctx->mb_height);
+        return AVERROR_INVALIDDATA;
+    }
 
     if (buf_size < ctx->data_offset) {
         av_log(ctx->avctx, AV_LOG_ERROR,