Permalink
Browse files

ffv1dec: check that global parameters dont change in version 0/1

Such changes are not allowed nor supported

Fixes Ticket2906

Found-by: ami_stuff
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
  • Loading branch information...
1 parent 20b965a commit 547d690d676064069d44703a1917e0dab7e33445 @michaelni michaelni committed Aug 30, 2013
Showing with 21 additions and 4 deletions.
  1. +21 −4 libavcodec/ffv1dec.c
View
@@ -580,6 +580,7 @@ static int read_header(FFV1Context *f)
memset(state, 128, sizeof(state));
if (f->version < 2) {
+ int chroma_planes, chroma_h_shift, chroma_v_shift, transparency;
unsigned v= get_symbol(c, state, 0);
if (v >= 2) {
av_log(f->avctx, AV_LOG_ERROR, "invalid version %d in ver01 header\n", v);
@@ -597,10 +598,26 @@ static int read_header(FFV1Context *f)
if (f->version > 0)
f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);
- f->chroma_planes = get_rac(c, state);
- f->chroma_h_shift = get_symbol(c, state, 0);
- f->chroma_v_shift = get_symbol(c, state, 0);
- f->transparency = get_rac(c, state);
+ chroma_planes = get_rac(c, state);
+ chroma_h_shift = get_symbol(c, state, 0);
+ chroma_v_shift = get_symbol(c, state, 0);
+ transparency = get_rac(c, state);
+
+ if (f->plane_count) {
+ if ( chroma_planes != f->chroma_planes
+ || chroma_h_shift!= f->chroma_h_shift
+ || chroma_v_shift!= f->chroma_v_shift
+ || transparency != f->transparency) {
+ av_log(f->avctx, AV_LOG_ERROR, "Invalid change of global parameters\n");
+ return AVERROR_INVALIDDATA;
+ }
+ }
+
+ f->chroma_planes = chroma_planes;
+ f->chroma_h_shift = chroma_h_shift;
+ f->chroma_v_shift = chroma_v_shift;
+ f->transparency = transparency;
+
f->plane_count = 2 + f->transparency;
}

0 comments on commit 547d690

Please sign in to comment.