Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:[email protected]
---
libavcodec/h264.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index c0dfa3d..46376e4 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -4495,6 +4495,11 @@ static int execute_decode_slices(H264Context *h, int
context_count)
H264Context *hx;
int i;
+ if (h->mb_y >= h->mb_height) {
+ av_log(h->avctx, AV_LOG_ERROR, "Too many MB rows.\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if (h->avctx->hwaccel)
return 0;
if (context_count == 1) {
--
1.7.10.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
