Commit 85c92789 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/h264_ps: Fix copying oversized pps&sps data

Fixes: https://trac.ffmpeg.org/attachment/ticket/685/movie.264

In the available testcase the actual PPS only uses a few bits
while there are 7kbyte of apparently random data after it
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 5fa5e73e
......@@ -312,8 +312,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation)
return AVERROR(ENOMEM);
sps->data_size = h->gb.buffer_end - h->gb.buffer;
if (sps->data_size > sizeof(sps->data))
goto fail;
if (sps->data_size > sizeof(sps->data)) {
av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized SPS\n");
sps->data_size = sizeof(sps->data);
}
memcpy(sps->data, h->gb.buffer, sps->data_size);
profile_idc = get_bits(&h->gb, 8);
......@@ -611,8 +613,8 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length)
return AVERROR(ENOMEM);
pps->data_size = h->gb.buffer_end - h->gb.buffer;
if (pps->data_size > sizeof(pps->data)) {
ret = AVERROR_INVALIDDATA;
goto fail;
av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized PPS\n");
pps->data_size = sizeof(pps->data);
}
memcpy(pps->data, h->gb.buffer, pps->data_size);
pps->sps_id = get_ue_golomb_31(&h->gb);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment