From 5d88e40093ffc9ed3d643516b4502edfe12d7756 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Sat, 12 Jul 2014 05:07:16 +0200
Subject: [PATCH] avcodec/hevc: check slice_header_extension data length
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavcodec/hevc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index 8ae8fc7648c..a64c627b02d 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -708,6 +708,10 @@ static int hls_slice_header(HEVCContext *s)
if (s->pps->slice_header_extension_present_flag) {
unsigned int length = get_ue_golomb_long(gb);
+ if (length*8LL > get_bits_left(gb)) {
+ av_log(s->avctx, AV_LOG_ERROR, "too many slice_header_extension_data_bytes\n");
+ return AVERROR_INVALIDDATA;
+ }
for (i = 0; i < length; i++)
skip_bits(gb, 8); // slice_header_extension_data_byte
}
--
GitLab