[FFmpeg-cvslog] mss2: only use error correction for matching block counts
Andreas Cadhalpun
git at videolan.org
Fri Nov 25 23:42:40 EET 2016
ffmpeg | branch: release/3.2 | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Thu Nov 24 23:57:46 2016 +0100| [d147114b9de0aa443388b429aad3a71859bf2af6] | committer: Andreas Cadhalpun
mss2: only use error correction for matching block counts
This fixes a heap-buffer-overflow in ff_er_frame_end when decoding mss2
with coded_width/coded_height larger than width/height.
Reviewed-by: Michael Niedermayer <michael at niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
(cherry picked from commit 2566ad98b01538ea589e5ee07b69fc566aadc348)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d147114b9de0aa443388b429aad3a71859bf2af6
---
libavcodec/mss2.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c
index 1e24568..581865b 100644
--- a/libavcodec/mss2.c
+++ b/libavcodec/mss2.c
@@ -422,7 +422,13 @@ static int decode_wmv9(AVCodecContext *avctx, const uint8_t *buf, int buf_size,
ff_vc1_decode_blocks(v);
- ff_er_frame_end(&s->er);
+ if (v->end_mb_x == s->mb_width && s->end_mb_y == s->mb_height) {
+ ff_er_frame_end(&s->er);
+ } else {
+ av_log(v->s.avctx, AV_LOG_WARNING,
+ "disabling error correction due to block count mismatch %dx%d != %dx%d\n",
+ v->end_mb_x, s->end_mb_y, s->mb_width, s->mb_height);
+ }
ff_mpv_frame_end(s);
More information about the ffmpeg-cvslog
mailing list