Skip to content

Commit f31fc47

Browse files
committed
avcodec/dnxhddec: Move mb height check out of non hr branch
Fixes: out of array access Fixes: poc.dnxhd Found-by: Bingchang, Liu@VARAS of IIE Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 296debd) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 665311a commit f31fc47

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

Diff for: libavcodec/dnxhddec.c

+6-2
Original file line numberDiff line numberDiff line change
@@ -278,14 +278,18 @@ static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame,
278278
if (header_prefix == DNXHD_HEADER_HR2) {
279279
ctx->data_offset = 0x170 + (ctx->mb_height << 2);
280280
} else {
281-
if (ctx->mb_height > 68 ||
282-
(ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
281+
if (ctx->mb_height > 68) {
283282
av_log(ctx->avctx, AV_LOG_ERROR,
284283
"mb height too big: %d\n", ctx->mb_height);
285284
return AVERROR_INVALIDDATA;
286285
}
287286
ctx->data_offset = 0x280;
288287
}
288+
if ((ctx->mb_height << frame->interlaced_frame) > (ctx->height + 15) >> 4) {
289+
av_log(ctx->avctx, AV_LOG_ERROR,
290+
"mb height too big: %d\n", ctx->mb_height);
291+
return AVERROR_INVALIDDATA;
292+
}
289293

290294
if (buf_size < ctx->data_offset) {
291295
av_log(ctx->avctx, AV_LOG_ERROR,

0 commit comments

Comments
 (0)