Abort as soon as we're done reading the slice header instead of running extra
checks
that assume slice data may follow.
Signed-off-by: James Almer <jamr...@gmail.com>
---
libavcodec/hevc/hevcdec.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index df186d6194..a7a91769fe 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -1160,6 +1160,12 @@ static int hls_slice_header(SliceHeader *sh, const
HEVCContext *s, GetBitContext
}
sh->data_offset = align_get_bits(gb) - gb->buffer;
+ if (get_bits_left(gb) < 0) {
+ av_log(s->avctx, AV_LOG_ERROR,
+ "Overread slice header by %d bits\n", -get_bits_left(gb));
+ return AVERROR_INVALIDDATA;
+ }
+
// Inferred parameters
sh->slice_qp = 26U + pps->pic_init_qp_minus26 + sh->slice_qp_delta;
if (sh->slice_qp > 51 ||
@@ -1180,12 +1186,6 @@ static int hls_slice_header(SliceHeader *sh, const
HEVCContext *s, GetBitContext
return AVERROR_INVALIDDATA;
}
- if (get_bits_left(gb) < 0) {
- av_log(s->avctx, AV_LOG_ERROR,
- "Overread slice header by %d bits\n", -get_bits_left(gb));
- return AVERROR_INVALIDDATA;
- }
-
return 0;
}
--
2.49.0
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
