Commit 6fafc62b authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/h264: Be more strict on rejecting pps/sps changes

Fixes race condition
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 31cc9c04
......@@ -1284,6 +1284,8 @@ int ff_h264_decode_slice_header(H264Context *h, H264Context *h0)
int must_reinit;
int needs_reinit = 0;
int field_pic_flag, bottom_field_flag;
int first_slice = h == h0 && !h0->current_slice;
PPS *pps;
h->qpel_put = h->h264qpel.put_h264_qpel_pixels_tab;
h->qpel_avg = h->h264qpel.avg_h264_qpel_pixels_tab;
......@@ -1357,18 +1359,27 @@ int ff_h264_decode_slice_header(H264Context *h, H264Context *h0)
h0->au_pps_id, pps_id);
return AVERROR_INVALIDDATA;
}
h->pps = *h0->pps_buffers[pps_id];
if (!h0->sps_buffers[h->pps.sps_id]) {
pps = h0->pps_buffers[pps_id];
if (!h0->sps_buffers[pps->sps_id]) {
av_log(h->avctx, AV_LOG_ERROR,
"non-existing SPS %u referenced\n",
h->pps.sps_id);
return AVERROR_INVALIDDATA;
}
if (first_slice)
h->pps = *h0->pps_buffers[pps_id];
if (pps->sps_id != h->sps.sps_id ||
pps->sps_id != h->current_sps_id ||
h0->sps_buffers[pps->sps_id]->new) {
if (h->pps.sps_id != h->sps.sps_id ||
h->pps.sps_id != h->current_sps_id ||
h0->sps_buffers[h->pps.sps_id]->new) {
if (!first_slice) {
av_log(h->avctx, AV_LOG_ERROR,
"SPS changed in the middle of the frame\n");
return AVERROR_INVALIDDATA;
}
h->sps = *h0->sps_buffers[h->pps.sps_id];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment