shithub: dav1d

Info  •  Files  •  Log  •  Branches

obu: also check frame_size_limit with Frame Header OBUs

--- a/src/obu.c

+++ b/src/obu.c

@@ -1297,14 +1297,7 @@

                 c->frame_hdr = NULL;

                 return DAV1D_ERR(EINVAL);

             }

-

-            break;

         }

-        // OBU_FRAMEs shouldn't be signalled with show_existing_frame

-        if (c->frame_hdr->show_existing_frame) {

-            c->frame_hdr = NULL;

-            goto error;

-        }

         if (c->frame_size_limit && (int64_t)c->frame_hdr->width[1] *

             c->frame_hdr->height > c->frame_size_limit)

@@ -1313,6 +1306,14 @@

                       c->frame_hdr->height, c->frame_size_limit);

             c->frame_hdr = NULL;

             return DAV1D_ERR(ERANGE);

+        }

+

+        if (type != OBU_FRAME)

+            break;

+        // OBU_FRAMEs shouldn't be signaled with show_existing_frame

+        if (c->frame_hdr->show_existing_frame) {

+            c->frame_hdr = NULL;

+            goto error;

         }

         // This is the frame header at the start of a frame OBU.