Commit 85c92789 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/h264_ps: Fix copying oversized pps&sps data

Fixes: https://trac.ffmpeg.org/attachment/ticket/685/movie.264

In the available testcase the actual PPS only uses a few bits
while there are 7kbyte of apparently random data after it
Signed-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 5fa5e73e
...@@ -312,8 +312,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation) ...@@ -312,8 +312,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h, int ignore_truncation)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
sps->data_size = h->gb.buffer_end - h->gb.buffer; sps->data_size = h->gb.buffer_end - h->gb.buffer;
if (sps->data_size > sizeof(sps->data)) if (sps->data_size > sizeof(sps->data)) {
goto fail; av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized SPS\n");
sps->data_size = sizeof(sps->data);
}
memcpy(sps->data, h->gb.buffer, sps->data_size); memcpy(sps->data, h->gb.buffer, sps->data_size);
profile_idc = get_bits(&h->gb, 8); profile_idc = get_bits(&h->gb, 8);
...@@ -611,8 +613,8 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length) ...@@ -611,8 +613,8 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
pps->data_size = h->gb.buffer_end - h->gb.buffer; pps->data_size = h->gb.buffer_end - h->gb.buffer;
if (pps->data_size > sizeof(pps->data)) { if (pps->data_size > sizeof(pps->data)) {
ret = AVERROR_INVALIDDATA; av_log(h->avctx, AV_LOG_WARNING, "Truncating likely oversized PPS\n");
goto fail; pps->data_size = sizeof(pps->data);
} }
memcpy(pps->data, h->gb.buffer, pps->data_size); memcpy(pps->data, h->gb.buffer, pps->data_size);
pps->sps_id = get_ue_golomb_31(&h->gb); pps->sps_id = get_ue_golomb_31(&h->gb);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment