diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 00:48:15 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 04:58:46 +0100 |
commit | 7845f8d282a98d5e01aaeddfa9af698697d8874d (patch) | |
tree | 92c76e7576032e6dc4f5849e18278b855e2ab1fc /libavcodec/vc1.c | |
parent | 8f42b09604a6751eb3d3c225b8270b708a8338f4 (diff) | |
download | ffmpeg-streaming-7845f8d282a98d5e01aaeddfa9af698697d8874d.zip ffmpeg-streaming-7845f8d282a98d5e01aaeddfa9af698697d8874d.tar.gz |
vc1dec: do not allow field_mode to change after the first header
Fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1.c')
-rw-r--r-- | libavcodec/vc1.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c index c1b73d6..fa0b916 100644 --- a/libavcodec/vc1.c +++ b/libavcodec/vc1.c @@ -834,6 +834,7 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) int status; int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */ int scale, shift, i; /* for initializing LUT for intensity compensation */ + int field_mode, fcm; v->numref=0; v->p_frame_skipped = 0; @@ -848,19 +849,23 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) goto parse_common_info; } - v->field_mode = 0; + field_mode = 0; if (v->interlace) { - v->fcm = decode012(gb); - if (v->fcm) { - if (v->fcm == ILACE_FIELD) - v->field_mode = 1; + fcm = decode012(gb); + if (fcm) { + if (fcm == ILACE_FIELD) + field_mode = 1; if (!v->warn_interlaced++) av_log(v->s.avctx, AV_LOG_ERROR, "Interlaced frames/fields support is incomplete\n"); } } else { - v->fcm = PROGRESSIVE; + fcm = PROGRESSIVE; } + if (!v->first_pic_header_flag && v->field_mode != field_mode) + return -1; + v->field_mode = field_mode; + v->fcm = fcm; if (v->field_mode) { v->fptype = get_bits(gb, 3); |