From 6e5cdf26281945ddea3aaf5eca4d127791f23ca8 Mon Sep 17 00:00:00 2001
From: Janne Grunau <janne-libav@jannau.net>
Date: Sun, 25 Nov 2012 16:02:02 +0100
Subject: [PATCH] h264: check ref_count validity for
num_ref_idx_active_override_flag
Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
CC: libav-stable@libav.org
---
libavcodec/h264.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 5440d7bc31a..8226d743268 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2841,8 +2841,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
if (num_ref_idx_active_override_flag) {
h->ref_count[0] = get_ue_golomb(&s->gb) + 1;
- if (h->slice_type_nos == AV_PICTURE_TYPE_B)
+ if (h->ref_count[0] < 1)
+ return AVERROR_INVALIDDATA;
+ if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
+ if (h->ref_count[1] < 1)
+ return AVERROR_INVALIDDATA;
+ }
}
if (h->slice_type_nos == AV_PICTURE_TYPE_B)
--
GitLab