From 404d527a49c44e461ab887280b576969a80d87c0 Mon Sep 17 00:00:00 2001 From: Kostya Shishkov Date: Wed, 11 Mar 2020 14:59:29 +0100 Subject: [PATCH] realmedia/rv3040: ignore slices with wrong headers --- nihav-realmedia/src/codecs/rv3040.rs | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/nihav-realmedia/src/codecs/rv3040.rs b/nihav-realmedia/src/codecs/rv3040.rs index d2ff139..e45b62b 100644 --- a/nihav-realmedia/src/codecs/rv3040.rs +++ b/nihav-realmedia/src/codecs/rv3040.rs @@ -539,10 +539,23 @@ fn decode_slice_header(br: &mut BitReader, bd: &mut RV34BitstreamDecoder, slice_ if slice_no < slice_offs.len() - 1 { let cur_pos = br.tell() as u32; br.seek((slice_offs[slice_no + 1] * 8) as u32)?; - let nhdr = bd.decode_slice_header(br, shdr.width, shdr.height)?; + if let Ok(nhdr) = bd.decode_slice_header(br, shdr.width, shdr.height) { + validate!(nhdr.start > shdr.start); + shdr.end = nhdr.start; + } else { + if slice_no + 2 < slice_offs.len() { + br.seek((slice_offs[slice_no + 2] * 8) as u32)?; + if let Ok(nhdr) = bd.decode_slice_header(br, shdr.width, shdr.height) { + validate!(nhdr.start > shdr.start); + shdr.end = nhdr.start; + } else { + shdr.end = ((shdr.width + 15) >> 4) * ((shdr.height + 15) >> 4); + } + } else { + shdr.end = ((shdr.width + 15) >> 4) * ((shdr.height + 15) >> 4); + } + } br.seek(cur_pos)?; - validate!(nhdr.start > shdr.start); - shdr.end = nhdr.start; } else { shdr.end = ((shdr.width + 15) >> 4) * ((shdr.height + 15) >> 4); } -- 2.39.5