aac_adtstoasc_bsf: Check extradata memory allocation

[ffmpeg] / libavcodec / h264_cavlc.c

diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c
index 171d84f585573a07531b3c0f20a0f0ea90324e33..0ab03551436e602dd5f34417571cf1d0abd4abd0 100644 (file)
--- a/libavcodec/h264_cavlc.c
+++ b/libavcodec/h264_cavlc.c
@@ -29,13 +29,12 @@
 
 #include "internal.h"
 #include "avcodec.h"
-#include "mpegvideo.h"
 #include "h264.h"
 #include "h264data.h" // FIXME FIXME FIXME
 #include "h264_mvpred.h"
 #include "golomb.h"
+#include "mpegutils.h"
 
-//#undef NDEBUG
 #include <assert.h>
 
 static const uint8_t golomb_to_inter_cbp_gray[16]={
@@ -766,6 +765,10 @@ decode_intra_mb:
 
         // We assume these blocks are very rare so we do not optimize it.
         h->intra_pcm_ptr = align_get_bits(&h->gb);
+        if (get_bits_left(&h->gb) < mb_size) {
+            av_log(h->avctx, AV_LOG_ERROR, "Not enough data for an intra PCM block.\n");
+            return AVERROR_INVALIDDATA;
+        }
         skip_bits_long(&h->gb, mb_size);
 
         // In deblocking, the quantizer is 0
@@ -1106,7 +1109,7 @@ decode_intra_mb:
             return -1;
         }
         h->cbp_table[mb_xy] |= ret << 12;
-        if(CHROMA444){
+        if (CHROMA444(h)) {
             if( decode_luma_residual(h, gb, scan, scan8x8, pixel_shift, mb_type, cbp, 1) < 0 ){
                 return -1;
             }