h264: check that luma and chroma depth match
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 21 Feb 2013 14:00:59 +0000 (15:00 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 21 Feb 2013 14:02:09 +0000 (15:02 +0100)
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h264_ps.c

index 49ba82e..2575293 100644 (file)
@@ -380,7 +380,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
         }
         sps->bit_depth_luma   = get_ue_golomb(&h->gb) + 8;
         sps->bit_depth_chroma = get_ue_golomb(&h->gb) + 8;
-        if (sps->bit_depth_luma > 14U || sps->bit_depth_chroma > 14U) {
+        if (sps->bit_depth_luma > 14U || sps->bit_depth_chroma > 14U || sps->bit_depth_luma != sps->bit_depth_chroma) {
             av_log(h->avctx, AV_LOG_ERROR, "illegal bit depth value (%d, %d)\n",
                    sps->bit_depth_luma, sps->bit_depth_chroma);
             goto fail;