On Mon, Dec 9, 2013 at 11:11 AM, Anton Khirnov <[email protected]> wrote: > > On Thu, 28 Nov 2013 15:03:01 +0100, Vittorio Giovara > <[email protected]> wrote: >> --- >> libavcodec/mpeg12dec.c | 63 >> +++++++++++++++++++++++++++++++++++++++--------- >> 1 file changed, 51 insertions(+), 12 deletions(-) >> >> diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c >> index 9d0c3be..633bbcf 100644 >> --- a/libavcodec/mpeg12dec.c >> +++ b/libavcodec/mpeg12dec.c >> @@ -27,6 +27,7 @@ >> >> #include "libavutil/attributes.h" >> #include "libavutil/internal.h" >> +#include "libavutil/stereo3d.h" >> #include "internal.h" >> #include "avcodec.h" >> #include "dsputil.h" >> @@ -2108,18 +2109,56 @@ static void mpeg_decode_user_data(AVCodecContext >> *avctx, >> const uint8_t *buf_end = p + buf_size; >> >> /* we parse the DTG active format information */ >> - if (buf_end - p >= 5 && >> - p[0] == 'D' && p[1] == 'T' && p[2] == 'G' && p[3] == '1') { >> - int flags = p[4]; >> - p += 5; >> - if (flags & 0x80) { >> - /* skip event id */ >> - p += 2; >> - } >> - if (flags & 0x40) { >> - if (buf_end - p < 1) >> - return; >> - avctx->dtg_active_format = p[0] & 0x0f; >> + if (buf_end - p >= 5) { >> + if (p[0] == 'D' && >> + p[1] == 'T' && >> + p[2] == 'G' && >> + p[3] == '1') { >> + int flags = p[4]; >> + p += 5; >> + if (flags & 0x80) { >> + /* skip event id */ >> + p += 2; >> + } >> + if (flags & 0x40) { >> + if (buf_end - p < 1) >> + return; >> + avctx->dtg_active_format = p[0] & 0x0f; >> + } >> + } else if (p[0] == 'J' && >> + p[1] == 'P' && >> + p[2] == '3' && >> + p[3] == 'D') { >> + if (p[4] == 0x03) { // S3D_video_format_length >> + // the mask ignores reserved_bit >> + const uint8_t S3D_video_format_type = p[5] & 0x7F; > > You are accessing the 6th byte, but only checked for 5 above.
Fixed locally (good catch): Vittorio > > -- > Anton Khirnov _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
