This tells the parsing functions the payload size and prevents them from
overreading.
---
libavcodec/h264_sei.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/libavcodec/h264_sei.c b/libavcodec/h264_sei.c
index 17f89ce..2e52227 100644
--- a/libavcodec/h264_sei.c
+++ b/libavcodec/h264_sei.c
@@ -350,6 +350,7 @@ int ff_h264_sei_decode(H264SEIContext *h, GetBitContext *gb,
const H264ParamSets *ps, void *logctx)
{
while (get_bits_left(gb) > 16) {
+ GetBitContext gb_payload;
int size = 0;
int type = 0;
int ret = 0;
@@ -374,37 +375,39 @@ int ff_h264_sei_decode(H264SEIContext *h, GetBitContext
*gb,
return AVERROR_INVALIDDATA;
}
+ ret = init_get_bits8(&gb_payload, gb->buffer + get_bits_count(gb) / 8,
size);
+ if (ret < 0)
+ return ret;
+
switch (type) {
case SEI_TYPE_PIC_TIMING: // Picture timing SEI
- ret = decode_picture_timing(&h->picture_timing, gb, ps->sps,
logctx);
+ ret = decode_picture_timing(&h->picture_timing, &gb_payload,
ps->sps, logctx);
break;
case SEI_TYPE_USER_DATA_REGISTERED:
- ret = decode_registered_user_data(h, gb, logctx, size);
+ ret = decode_registered_user_data(h, &gb_payload, logctx, size);
break;
case SEI_TYPE_USER_DATA_UNREGISTERED:
- ret = decode_unregistered_user_data(&h->unregistered, gb, logctx,
size);
+ ret = decode_unregistered_user_data(&h->unregistered, &gb_payload,
logctx, size);
break;
case SEI_TYPE_RECOVERY_POINT:
- ret = decode_recovery_point(&h->recovery_point, gb);
+ ret = decode_recovery_point(&h->recovery_point, &gb_payload);
break;
case SEI_TYPE_BUFFERING_PERIOD:
- ret = decode_buffering_period(&h->buffering_period, gb, ps,
logctx);
+ ret = decode_buffering_period(&h->buffering_period, &gb_payload,
ps, logctx);
break;
case SEI_TYPE_FRAME_PACKING:
- ret = decode_frame_packing_arrangement(&h->frame_packing, gb);
+ ret = decode_frame_packing_arrangement(&h->frame_packing,
&gb_payload);
break;
case SEI_TYPE_DISPLAY_ORIENTATION:
- ret = decode_display_orientation(&h->display_orientation, gb);
+ ret = decode_display_orientation(&h->display_orientation,
&gb_payload);
break;
default:
av_log(logctx, AV_LOG_DEBUG, "unknown SEI type %d\n", type);
- skip_bits(gb, 8 * size);
}
if (ret < 0)
return ret;
- // FIXME check bits here
- align_get_bits(gb);
+ skip_bits(gb, 8 * size);
}
return 0;
--
2.0.0
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
