diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-07 18:45:25 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-07 18:52:43 +0400 |
commit | 7c425e4f2d677477e43cd5ce0d3a5348123b8c2f (patch) | |
tree | 0cf10f859078c4d6813c3465ebcf13c1ec61c1cf | |
parent | af164d7d9f12f9c2a4b284957eb92ad74cd49b3d (diff) | |
parent | d7d6efe42b0d2057e67999b96b9a391f533d2333 (diff) |
Merge commit 'd7d6efe42b0d2057e67999b96b9a391f533d2333'
* commit 'd7d6efe42b0d2057e67999b96b9a391f533d2333':
h264: check sps.log2_max_frame_num for validity
mov: validate number of DataReferenceBox entries against box size
mov: compute avg_frame_rate only if duration is known
flac: change minimum and default of lpc_passes option to 1
Conflicts:
libavcodec/h264_ps.c
libavformat/mov.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavcodec/flacenc.c | 2 | ||||
-rw-r--r-- | libavcodec/h264_ps.c | 16 | ||||
-rw-r--r-- | libavformat/mov.c | 6 |
3 files changed, 16 insertions, 8 deletions
diff --git a/libavcodec/flacenc.c b/libavcodec/flacenc.c index a3c4e64114..dd2c8a7f24 100644 --- a/libavcodec/flacenc.c +++ b/libavcodec/flacenc.c @@ -1320,7 +1320,7 @@ static const AVOption options[] = { { "fixed", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = FF_LPC_TYPE_FIXED }, INT_MIN, INT_MAX, FLAGS, "lpc_type" }, { "levinson", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = FF_LPC_TYPE_LEVINSON }, INT_MIN, INT_MAX, FLAGS, "lpc_type" }, { "cholesky", NULL, 0, AV_OPT_TYPE_CONST, {.i64 = FF_LPC_TYPE_CHOLESKY }, INT_MIN, INT_MAX, FLAGS, "lpc_type" }, -{ "lpc_passes", "Number of passes to use for Cholesky factorization during LPC analysis", offsetof(FlacEncodeContext, options.lpc_passes), AV_OPT_TYPE_INT, {.i64 = -1 }, INT_MIN, INT_MAX, FLAGS }, +{ "lpc_passes", "Number of passes to use for Cholesky factorization during LPC analysis", offsetof(FlacEncodeContext, options.lpc_passes), AV_OPT_TYPE_INT, {.i64 = 2 }, 1, INT_MAX, FLAGS }, { "min_partition_order", NULL, offsetof(FlacEncodeContext, options.min_partition_order), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, MAX_PARTITION_ORDER, FLAGS }, { "max_partition_order", NULL, offsetof(FlacEncodeContext, options.max_partition_order), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, MAX_PARTITION_ORDER, FLAGS }, { "prediction_order_method", "Search method for selecting prediction order", offsetof(FlacEncodeContext, options.prediction_order_method), AV_OPT_TYPE_INT, {.i64 = -1 }, -1, ORDER_METHOD_LOG, FLAGS, "predm" }, diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 28d3cbc2c3..aef1ca6ba1 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -37,6 +37,9 @@ //#undef NDEBUG #include <assert.h> +#define MAX_LOG2_MAX_FRAME_NUM (12 + 4) +#define MIN_LOG2_MAX_FRAME_NUM 4 + static const AVRational pixel_aspect[17]={ {0, 1}, {1, 1}, @@ -331,7 +334,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ MpegEncContext * const s = &h->s; int profile_idc, level_idc, constraint_set_flags = 0; unsigned int sps_id; - int i; + int i, log2_max_frame_num_minus4; SPS *sps; profile_idc= get_bits(&s->gb, 8); @@ -394,12 +397,15 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ sps->bit_depth_chroma = 8; } - sps->log2_max_frame_num= get_ue_golomb(&s->gb) + 4; - if (sps->log2_max_frame_num < 4 || sps->log2_max_frame_num > 16) { - av_log(h->s.avctx, AV_LOG_ERROR, "illegal log2_max_frame_num %d\n", - sps->log2_max_frame_num); + log2_max_frame_num_minus4 = get_ue_golomb(&s->gb); + if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 || + log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) { + av_log(h->s.avctx, AV_LOG_ERROR, + "log2_max_frame_num_minus4 out of range (0-12): %d\n", + log2_max_frame_num_minus4); goto fail; } + sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4; sps->poc_type= get_ue_golomb_31(&s->gb); diff --git a/libavformat/mov.c b/libavformat/mov.c index f380b396e1..046e9b82ee 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -429,6 +429,7 @@ static int mov_read_chpl(MOVContext *c, AVIOContext *pb, MOVAtom atom) return 0; } +#define MIN_DATA_ENTRY_BOX_SIZE 12 static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) { AVStream *st; @@ -442,7 +443,8 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) avio_rb32(pb); // version + flags entries = avio_rb32(pb); - if (entries >= UINT_MAX / sizeof(*sc->drefs)) + if (entries > (atom.size - 1) / MIN_DATA_ENTRY_BOX_SIZE + 1 || + entries >= UINT_MAX / sizeof(*sc->drefs)) return AVERROR_INVALIDDATA; av_free(sc->drefs); sc->drefs_count = 0; @@ -2222,7 +2224,7 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom) if (st->duration > 0) av_reduce(&st->avg_frame_rate.num, &st->avg_frame_rate.den, - sc->time_scale*st->nb_frames, st->duration, INT_MAX); + sc->time_scale*st->nb_frames, st->duration, INT_MAX); #if FF_API_R_FRAME_RATE if (sc->stts_count == 1 || (sc->stts_count == 2 && sc->stts_data[1].count == 1)) |