[FFmpeg-cvslog] avcodec/dnxhddec: Move mb height check out of non hr branch

Michael Niedermayer git at videolan.org
Tue Aug 1 15:45:18 EEST 2017


ffmpeg | branch: release/3.1 | Michael Niedermayer <michael at niedermayer.cc> | Wed Jul 26 03:26:59 2017 +0200| [956f2db21ffc1ca7f8dae7a3f44b09a145d9b9fa] | committer: Michael Niedermayer

avcodec/dnxhddec: Move mb height check out of non hr branch

Fixes: out of array access
Fixes: poc.dnxhd

Found-by: Bingchang, Liu at VARAS of IIE
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 296debd213bd6dce7647cedd34eb64e5b94cdc92)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=956f2db21ffc1ca7f8dae7a3f44b09a145d9b9fa
---

 libavcodec/dnxhddec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index cb1fc798b2..862e964b51 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -273,14 +273,18 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
     if (header_prefix == DNXHD_HEADER_HR2) {
         ctx->data_offset = 0x170 + (ctx->mb_height << 2);
     } else {
-        if (ctx->mb_height > 68 ||
-            (ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        if (ctx->mb_height > 68) {
             av_log(ctx->avctx, AV_LOG_ERROR,
                    "mb height too big: %d\n", ctx->mb_height);
             return AVERROR_INVALIDDATA;
         }
         ctx->data_offset = 0x280;
     }
+    if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
+        av_log(ctx->avctx, AV_LOG_ERROR,
+                "mb height too big: %d\n", ctx->mb_height);
+        return AVERROR_INVALIDDATA;
+    }
 
     if (buf_size < ctx->data_offset) {
         av_log(ctx->avctx, AV_LOG_ERROR,



More information about the ffmpeg-cvslog mailing list