h264: reject mismatching luma/chroma bit depths during sps parsing

There is no point in delaying the check and it avoids bugs with a half-initialized context. Fixes invalid reads.

Anton Khirnov committed 12 years ago

Commit bfd26b71 parent 9a026c72 files · +5 −6Browse files

Unified · Split

2 files

libavcodec/h264.c +0 −6
libavcodec/h264_ps.c +5 −0

libavcodec/h264.c+0−6

@@ -3053,12 +3053,6 @@ static int h264_set_parameter_from_sps(H264Context *h) · 3052 unmodified lines
3053	3053	if (h->avctx->has_b_frames < 2)
3054	3054	h->avctx->has_b_frames = !h->low_delay;
3055	3055
3056		− if (h->sps.bit_depth_luma != h->sps.bit_depth_chroma) {
3057		− avpriv_request_sample(h->avctx,
3058		− "Different chroma and luma bit depth");
3059		− return AVERROR_PATCHWELCOME;
3060		− }
3061		−
3062	3056	if (h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma \|\|
3063	3057	h->cur_chroma_format_idc != h->sps.chroma_format_idc) {
3064	3058	if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {

libavcodec/h264_ps.c+5−0

@@ -341,6 +341,11 @@ int ff_h264_decode_seq_parameter_set(H264Context *h) · 340 unmodified lines
341	341	}
342	342	sps->bit_depth_luma = get_ue_golomb(&h->gb) + 8;
343	343	sps->bit_depth_chroma = get_ue_golomb(&h->gb) + 8;
	344	+ if (sps->bit_depth_chroma != sps->bit_depth_luma) {
	345	+ avpriv_request_sample(h->avctx,
	346	+ "Different chroma and luma bit depth");
	347	+ goto fail;
	348	+ }
344	349	sps->transform_bypass = get_bits1(&h->gb);
345	350	decode_scaling_matrices(h, sps, NULL, 1,
346	351	sps->scaling_matrix4, sps->scaling_matrix8);