mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-23 19:58:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/vp3: ensure header is parsed successfully before tables

Browse Source 
Fixes assertion failure
Fixes: 266ee543812e934f7b4a72923a2701d4/signal_sigabrt_7ffff6ae7cc9_7322_85218d61759d461bdf7387180e8000c9.ogg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-12-02 22:59:56 +01:00
parent ec7a3be11e
commit 26379d4fdd
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/vp3.c
View File

@ -131,7 +131,7 @@ static const uint8_t hilbert_offset[16][2] = {
typedef struct Vp3DecodeContext {
AVCodecContext *avctx;
int theora, theora_tables;
int theora, theora_tables, theora_header;
int version;
int width, height;
int chroma_x_shift, chroma_y_shift;
@ -2258,6 +2258,7 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
int ret;
AVRational fps, aspect;
s->theora_header = 0;
s->theora = get_bits_long(gb, 24);
av_log(avctx, AV_LOG_DEBUG, "Theora bitstream version %X\n", s->theora);
@ -2363,6 +2364,7 @@ static int theora_decode_header(AVCodecContext *avctx, GetBitContext *gb)
avctx->color_trc = AVCOL_TRC_BT709;
}
s->theora_header = 1;
return 0;
}
@ -2371,6 +2373,9 @@ static int theora_decode_tables(AVCodecContext *avctx, GetBitContext *gb)
Vp3DecodeContext *s = avctx->priv_data;
int i, n, matrices, inter, plane;
if (!s->theora_header)
return AVERROR_INVALIDDATA;
if (s->theora >= 0x030200) {
n = get_bits(gb, 3);
/* loop filter limit values table */