Commit 5a9e3760 authored by Michael Niedermayer's avatar Michael Niedermayer

h264: check mb_width/height

Fixes inconsistency that leads to out of array accesses with threads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent edabbfba
...@@ -3310,7 +3310,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0) ...@@ -3310,7 +3310,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
|| 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height || 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height
|| h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma || h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma
|| h->cur_chroma_format_idc != h->sps.chroma_format_idc || h->cur_chroma_format_idc != h->sps.chroma_format_idc
|| av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio))); || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio)
|| h->mb_width != h->sps.mb_width
|| h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag)
));
if (h0->avctx->pix_fmt != get_pixel_format(h0, 0)) if (h0->avctx->pix_fmt != get_pixel_format(h0, 0))
must_reinit = 1; must_reinit = 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment