mirrors/ffmpeg
0
0 Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 10:04:37 +08:00
Code Activity

avcodec/h263dec: Check against previous dimensions instead of coded

Browse Source 
Fixes: out of array access
Fixes: crash-a41ef3db699013f669b076f02f36942925f5a98c

Found-by: Kacper Michajlow <kasper93@gmail.com>
Reviewed-by: Kacper Michajlow <kasper93@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0fe33c99a2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer committed 2025-08-04 16:35:54 +02:00
1 parent 1b1acf964f
commit 07bd4b68f7
1 file changed
+9 -4
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/h263dec.c
+9 -4
View File
@@ -433,6 +433,7 @@ int ff_h263_decode_frame(AVCodecContext *avctx, AVFrame *pict,
MpegEncContext *s = avctx->priv_data;
int ret;
int slice_ret = 0;
int bak_width, bak_height;
/* no supplementary picture */
if (buf_size == 0) {
@@ -498,6 +499,9 @@ retry:
// we need the idct permutation for reading a custom matrix
ff_mpv_idct_init(s);
bak_width = s->width;
bak_height = s->height;
/* let's go :-) */
if (CONFIG_WMV2_DECODER && s->msmpeg4_version == 5) {
ret = ff_wmv2_decode_picture_header(s);
@@ -520,11 +524,12 @@ retry:
}
if (ret < 0 || ret == FRAME_SKIPPED) {
if ( s->width != avctx->coded_width
|| s->height != avctx->coded_height) {
if ( s->width != bak_width
|| s->height != bak_height) {
av_log(s->avctx, AV_LOG_WARNING, "Reverting picture dimensions change due to header decoding failure\n");
s->width = avctx->coded_width;
s->height= avctx->coded_height;
s->width = bak_width;
s->height= bak_height;
}
}
if (ret == FRAME_SKIPPED)