summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnton Khirnov <anton@khirnov.net>2012-12-13 17:53:31 +0100
committerReinhard Tartler <siretart@tauware.de>2013-02-12 07:12:00 +0100
commit0b25c3b67cef73ab1370db99da906ebc215a3c72 (patch)
tree8c0f139ec6b291033778ab956b7f86fb65eb029a
parentb9500bf864e9b5619f9d3b1331f4487a1a70ecf4 (diff)
downloadffmpeg-0b25c3b67cef73ab1370db99da906ebc215a3c72.tar.gz
mpeg12: do not decode extradata more than once.
Fixes CVE-2012-2803. (cherry picked from commit 582368626188c070d4300913c6da5efa4c24cfb2) (cherry picked from commit 301761792a693a1f3303a2af34a0fb066a03c10c) Conflicts: libavcodec/mpeg12.c
-rw-r--r--libavcodec/mpeg12.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/mpeg12.c b/libavcodec/mpeg12.c
index 9e67ee5c61..95d128214d 100644
--- a/libavcodec/mpeg12.c
+++ b/libavcodec/mpeg12.c
@@ -1163,6 +1163,7 @@ typedef struct Mpeg1Context {
int save_width, save_height;
AVRational frame_rate_ext; ///< MPEG-2 specific framerate modificator
+ int extradata_decoded;
} Mpeg1Context;
static av_cold int mpeg_decode_init(AVCodecContext *avctx)
@@ -2299,8 +2300,10 @@ static int mpeg_decode_frame(AVCodecContext *avctx,
s->slice_count= 0;
- if(avctx->extradata && !avctx->frame_number)
+ if (avctx->extradata && !s->extradata_decoded) {
decode_chunks(avctx, picture, data_size, avctx->extradata, avctx->extradata_size);
+ s->extradata_decoded = 1;
+ }
return decode_chunks(avctx, picture, data_size, buf, buf_size);
}