h264: check mb_width/height
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 5 May 2013 23:37:34 +0000 (01:37 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 15 Jan 2014 23:52:56 +0000 (00:52 +0100)
Fixes inconsistency that leads to out of array accesses with threads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5a9e3760495e8678ae87314670e3d9d5a1792c8d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h264.c

index 4ecfa40..001882b 100644 (file)
@@ -3208,7 +3208,10 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
                      || 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height
                      || h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma
                      || h->cur_chroma_format_idc != h->sps.chroma_format_idc
-                     || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio)));
+                     || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio)
+                     || h->mb_width  != h->sps.mb_width
+                     || h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag)
+                    ));
     if (h0->avctx->pix_fmt != get_pixel_format(h0, 0))
         must_reinit = 1;