ffmpeg | branch: master | Michael Niedermayer <michae...@gmx.at> | Sat Jul 19 16:43:13 2014 +0200| [ba80b8d29b2adc7fd74324c9bd50cd0be7ab2c21] | committer: Michael Niedermayer
avcodec/hevc: check nb_cpb Signed-off-by: Michael Niedermayer <michae...@gmx.at> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ba80b8d29b2adc7fd74324c9bd50cd0be7ab2c21 --- libavcodec/hevc_ps.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 2a321a0..189b3d6 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -265,7 +265,7 @@ static void decode_sublayer_hrd(HEVCContext *s, unsigned int nb_cpb, } } -static void decode_hrd(HEVCContext *s, int common_inf_present, +static int decode_hrd(HEVCContext *s, int common_inf_present, int max_sublayers) { GetBitContext *gb = &s->HEVClc->gb; @@ -312,14 +312,20 @@ static void decode_hrd(HEVCContext *s, int common_inf_present, else low_delay = get_bits1(gb); - if (!low_delay) + if (!low_delay) { nb_cpb = get_ue_golomb_long(gb) + 1; + if (nb_cpb < 1 || nb_cpb > 32) { + av_log(s->avctx, AV_LOG_ERROR, "nb_cpb %d invalid\n", nb_cpb); + return AVERROR_INVALIDDATA; + } + } if (nal_params_present) decode_sublayer_hrd(s, nb_cpb, subpic_params_present); if (vcl_params_present) decode_sublayer_hrd(s, nb_cpb, subpic_params_present); } + return 0; } int ff_hevc_decode_nal_vps(HEVCContext *s) _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog