diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-07 05:34:48 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 03:13:08 +0300 |
| commit | 1081c9decc63931e30438c8f2490837c7eb7e26a (patch) | |
| tree | 745611cf3a0dd90067dce754528179f69c000937 | |
| parent | a22da15b0cace003b445b8c232338f70eb90451a (diff) | |
avcodec/h264_slice: ignore SAR changes in slices after the first
Fixes race condition and null pointer dereference
Fixes: signal_sigsegv_1472ac3_468_cov_2915641226_CABACI3_Sony_B.jsv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 38d5241b7f36c1571a88517a0650caade16dd5f4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Conflicts:
libavcodec/h264_slice.c
| -rw-r--r-- | libavcodec/h264.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index fa47542683..5bf5039332 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3242,6 +3242,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0) int last_pic_structure, last_pic_droppable; int must_reinit; int needs_reinit = 0; + int first_slice = h == h0 && !h0->current_slice; h->me.qpel_put = h->h264qpel.put_h264_qpel_pixels_tab; h->me.qpel_avg = h->h264qpel.avg_h264_qpel_pixels_tab; @@ -3336,13 +3337,15 @@ static int decode_slice_header(H264Context *h, H264Context *h0) || 16*h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) != h->avctx->coded_height || h->avctx->bits_per_raw_sample != h->sps.bit_depth_luma || h->cur_chroma_format_idc != h->sps.chroma_format_idc - || av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio) || h->mb_width != h->sps.mb_width || h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag) )); if (h0->avctx->pix_fmt != get_pixel_format(h0, 0)) must_reinit = 1; + if (first_slice && av_cmp_q(h->sps.sar, h->avctx->sample_aspect_ratio)) + must_reinit = 1; + h->mb_width = h->sps.mb_width; h->mb_height = h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag); h->mb_num = h->mb_width * h->mb_height; |