h264: reject mismatching luma/chroma bit depths during sps parsing
authorAnton Khirnov <anton@khirnov.net>
Thu, 28 Nov 2013 09:54:35 +0000 (10:54 +0100)
committerAnton Khirnov <anton@khirnov.net>
Mon, 6 Jan 2014 07:23:45 +0000 (08:23 +0100)
There is no point in delaying the check and it avoids bugs with a
half-initialized context.

Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org

libavcodec/h264.c
libavcodec/h264_ps.c

index e3dfbfb..c0dfa3d 100644 (file)
@@ -3053,12 +3053,6 @@ static int h264_set_parameter_from_sps(H264Context *h)
     if (h->avctx->has_b_frames < 2)
         h->avctx->has_b_frames = !h->low_delay;
 
-    if (h->sps.bit_depth_luma != h->sps.bit_depth_chroma) {
-        avpriv_request_sample(h->avctx,
-                              "Different chroma and luma bit depth");
-        return AVERROR_PATCHWELCOME;
-    }
-
     if (h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma ||
         h->cur_chroma_format_idc      != h->sps.chroma_format_idc) {
         if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) {
index 54b735d..9eb252d 100644 (file)
@@ -341,6 +341,11 @@ int ff_h264_decode_seq_parameter_set(H264Context *h)
         }
         sps->bit_depth_luma   = get_ue_golomb(&h->gb) + 8;
         sps->bit_depth_chroma = get_ue_golomb(&h->gb) + 8;
+        if (sps->bit_depth_chroma != sps->bit_depth_luma) {
+            avpriv_request_sample(h->avctx,
+                                  "Different chroma and luma bit depth");
+            goto fail;
+        }
         sps->transform_bypass = get_bits1(&h->gb);
         decode_scaling_matrices(h, sps, NULL, 1,
                                 sps->scaling_matrix4, sps->scaling_matrix8);