[libav-stable] h264: reset data_partitioning if decoding the slice header for NAL_DPA fails

Reinhard Tartler siretart at gmail.com
Sun Jan 5 22:55:46 CET 2014


In release/9, there is no field data_partitioning. Does this mean that
the problem does not exist in earlier releases?

Reinhard

On Fri, Jan 3, 2014 at 11:05 AM, Anton Khirnov <git at libav.org> wrote:
> Module: libav
> Branch: master
> Commit: 58312b2472d3a44d7458865c459d59ef2e02bf1a
>
> Author:    Anton Khirnov <anton at khirnov.net>
> Committer: Anton Khirnov <anton at khirnov.net>
> Date:      Thu Nov 28 10:54:35 2013 +0100
>
> h264: reset data_partitioning if decoding the slice header for NAL_DPA fails
>
> If it was set before then we can end up trying to decode a slice without
> a valid slice header, which can lead to invalid memory access.
>
> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC:libav-stable at libav.org
>
> ---
>
>  libavcodec/h264.c |    7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/h264.c b/libavcodec/h264.c
> index f610d71..3aa3af0 100644
> --- a/libavcodec/h264.c
> +++ b/libavcodec/h264.c
> @@ -4725,8 +4725,13 @@ again:
>                  hx->intra_gb_ptr =
>                  hx->inter_gb_ptr = NULL;
>
> -                if ((err = decode_slice_header(hx, h)) < 0)
> +                if ((err = decode_slice_header(hx, h)) < 0) {
> +                    /* make sure data_partitioning is cleared if it was set
> +                     * before, so we don't try decoding a slice without a valid
> +                     * slice header later */
> +                    h->data_partitioning = 0;
>                      break;
> +                }
>
>                  hx->data_partitioning = 1;
>                  break;
>
> _______________________________________________
> libav-stable mailing list
> libav-stable at libav.org
> https://lists.libav.org/mailman/listinfo/libav-stable



-- 
regards,
    Reinhard


More information about the libav-stable mailing list