Commit 0ba64ee5 authored by Janne Grunau's avatar Janne Grunau Committed by Ronald S. Bultje

obu/tile_group: simplify tile group order to check

The simplified versions catches tg_start != 0 for the first tile group
too. Fixes a heap-buffer-overflow in setup_tile when the first tile index is
larger than 0 but the number of tiles is correct. Fixes #61, #73.
parent b004c1a7
Pipeline #1158 passed with stage
in 2 minutes
......@@ -1046,10 +1046,9 @@ int dav1d_parse_obus(Dav1dContext *const c, Dav1dData *const in) {
c->tile[c->n_tile_data].data.ref = in->ref;
c->tile[c->n_tile_data].data.data = in->data + off;
c->tile[c->n_tile_data].data.sz = len + init_off - off;
// ensure tile groups are in order and sane, see 6.10.1
if (c->tile[c->n_tile_data].start > c->tile[c->n_tile_data].end ||
(c->n_tile_data > 0 &&
(c->tile[c->n_tile_data].start !=
c->tile[c->n_tile_data - 1].end + 1)))
c->tile[c->n_tile_data].start != c->n_tiles)
{
for (int i = 0; i <= c->n_tile_data; i++)
dav1d_data_unref(&c->tile[i].data);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment