Module: libav Branch: release/0.8 Commit: adef01c370c909ed639dde3277476fab704589be
Author: Janne Grunau <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Sat Jan 12 17:22:50 2013 +0100 h264: check ref_count validity for num_ref_idx_active_override_flag Fixes segfault in the fuzzed sample bipbop234.ts_s226407. CC: [email protected] (cherry-picked from commit 6e5cdf26281945ddea3aaf5eca4d127791f23ca8) Signed-off-by: Janne Grunau <[email protected]> --- libavcodec/h264.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 002477b..f3a47fe 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3121,8 +3121,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ if(num_ref_idx_active_override_flag){ h->ref_count[0]= get_ue_golomb(&s->gb) + 1; - if(h->slice_type_nos==AV_PICTURE_TYPE_B) + if (h->ref_count[0] < 1) + return AVERROR_INVALIDDATA; + if (h->slice_type_nos == AV_PICTURE_TYPE_B) { h->ref_count[1]= get_ue_golomb(&s->gb) + 1; + if (h->ref_count[1] < 1) + return AVERROR_INVALIDDATA; + } } if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) { _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
