Commit 58312b24 authored by Anton Khirnov's avatar Anton Khirnov

h264: reset data_partitioning if decoding the slice header for NAL_DPA fails

If it was set before then we can end up trying to decode a slice without
a valid slice header, which can lead to invalid memory access.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
parent e89aa4bf
...@@ -4725,8 +4725,13 @@ again: ...@@ -4725,8 +4725,13 @@ again:
hx->intra_gb_ptr = hx->intra_gb_ptr =
hx->inter_gb_ptr = NULL; hx->inter_gb_ptr = NULL;
if ((err = decode_slice_header(hx, h)) < 0) if ((err = decode_slice_header(hx, h)) < 0) {
/* make sure data_partitioning is cleared if it was set
* before, so we don't try decoding a slice without a valid
* slice header later */
h->data_partitioning = 0;
break; break;
}
hx->data_partitioning = 1; hx->data_partitioning = 1;
break; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment