From 1a8c6917f68f7378465e18f7615762bfd22704c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jind=C5=99ich=20Makovi=C4=8Dka?= <makovick@gmail.com>
Date: Sat, 29 Sep 2012 11:16:45 +0200
Subject: [PATCH] h264: avoid stuck buffer pointer in decode_nal_units
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When decode_nal_units() previously encountered a NAL_END_SEQUENCE,
and there are some junk bytes left in the input buffer, but no start codes,
buf_index gets stuck 3 bytes before the end of the buffer.
This can trigger an infinite loop in the caller code, eg. in
try_decode_trame(), as avcodec_decode_video() then keeps returning zeroes,
with 3 bytes of the input packet still available.
With this change, the remaining bytes are skipped so the whole packet gets
consumed.
CC:libav-stable@libav.org
Signed-off-by: JindÅ™ich MakoviÄka <makovick@gmail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
libavcodec/h264.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 99cf5dc9f39..5de7f104ca4 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -3694,8 +3694,10 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size)
buf[buf_index + 2] == 1)
break;
- if (buf_index + 3 >= buf_size)
+ if (buf_index + 3 >= buf_size) {
+ buf_index = buf_size;
break;
+ }
buf_index += 3;
if (buf_index >= next_avc)
--
GitLab