diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-04 02:52:38 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-04 03:07:27 +0400 |
| commit | e708424b70bef8641e8a090ec4d9e8c4490db87e (patch) | |
| tree | a7c8e562b6bd47754969b3ec4f43cbb29fa9ca34 /libavcodec/h264.h | |
| parent | 1a96b27ebfa908f60510be0537508b7c9b370be0 (diff) | |
avcodec/h264: Disallow pps_id changing between slices
Such changes are forbidden in H.264 and lead to race conditions
Fixes out of array read
Fixes: signal_sigsegv_f9796a_1613_cov_3114610371_FM1_BT_B.h264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264.h')
| -rw-r--r-- | libavcodec/h264.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/h264.h b/libavcodec/h264.h index 916f1043d1..6606d0b973 100644 --- a/libavcodec/h264.h +++ b/libavcodec/h264.h @@ -390,6 +390,8 @@ typedef struct H264Context { */ PPS pps; // FIXME move to Picture perhaps? (->no) do we need that? + int au_pps_id; ///< pps_id of current access unit + uint32_t dequant4_buffer[6][QP_MAX_NUM + 1][16]; // FIXME should these be moved down? uint32_t dequant8_buffer[6][QP_MAX_NUM + 1][64]; uint32_t(*dequant4_coeff[6])[16]; |