dilim/FFmpeg
1
0 Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-11-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cavsdec: reject the error returns of get_ue_golomb()

Browse Source 
get_ue_golomb() returns AVERROR_INVALIDDATA on thirteen or more leading
zero bits. Two callers used the value unchecked: mb_type reached
decode_mb_p() with a value no case of its switch covers, leaving
ff_cavs_inter() and ff_cavs_filter() to index ff_cavs_partition_flags[]
with it, and mb_skip_run was decremented from negative. decode_mb_b()
already rejects the first, so do it the same way.

Only the unsigned underlying type of enum cavs_mb hid the first under
gcc and clang; that is a compiler's choice, not a guarantee.

Signed-off-by: Rainbaby <r@bgr.jp>
This commit is contained in:
Rainbaby authored and Peter Ross committed 2026-11-02 22:18:06 +00:00
1 parent 0cec225102
commit d11fcddf17
1 file changed
+13
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/cavsdec.c
+13
View File
@@ -780,6 +780,11 @@ static int decode_mb_p(AVSContext *h, enum cavs_mb mb_type)
ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN, BLK_8X8, ref[1]);
ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN, BLK_8X8, ref[2]);
ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN, BLK_8X8, ref[3]);
break;
default:
av_log(h->avctx, AV_LOG_ERROR, "Invalid mb_type %d in P frame\n",
mb_type);
return AVERROR_INVALIDDATA;
}
ff_cavs_inter(h, mb_type);
set_intra_mode_default(h);
@@ -1162,6 +1167,10 @@ static int decode_pic(AVSContext *h)
break;
}
skip_count = get_ue_golomb(&h->gb);
if (skip_count < 0) {
ret = AVERROR_INVALIDDATA;
break;
}
}
if (h->skip_mode_flag && skip_count--) {
ret = decode_mb_p(h, P_SKIP);
@@ -1199,6 +1208,10 @@ static int decode_pic(AVSContext *h)
break;
}
skip_count = get_ue_golomb(&h->gb);
if (skip_count < 0) {
ret = AVERROR_INVALIDDATA;
break;
}
}
if (h->skip_mode_flag && skip_count--) {
ret = decode_mb_b(h, B_SKIP);