From ba80b8d29b2adc7fd74324c9bd50cd0be7ab2c21 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Sat, 19 Jul 2014 16:43:13 +0200
Subject: [PATCH] avcodec/hevc: check nb_cpb
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavcodec/hevc_ps.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 2a321a08a3e..189b3d6b5c3 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -265,7 +265,7 @@ static void decode_sublayer_hrd(HEVCContext *s, unsigned int nb_cpb,
}
}
-static void decode_hrd(HEVCContext *s, int common_inf_present,
+static int decode_hrd(HEVCContext *s, int common_inf_present,
int max_sublayers)
{
GetBitContext *gb = &s->HEVClc->gb;
@@ -312,14 +312,20 @@ static void decode_hrd(HEVCContext *s, int common_inf_present,
else
low_delay = get_bits1(gb);
- if (!low_delay)
+ if (!low_delay) {
nb_cpb = get_ue_golomb_long(gb) + 1;
+ if (nb_cpb < 1 || nb_cpb > 32) {
+ av_log(s->avctx, AV_LOG_ERROR, "nb_cpb %d invalid\n", nb_cpb);
+ return AVERROR_INVALIDDATA;
+ }
+ }
if (nal_params_present)
decode_sublayer_hrd(s, nb_cpb, subpic_params_present);
if (vcl_params_present)
decode_sublayer_hrd(s, nb_cpb, subpic_params_present);
}
+ return 0;
}
int ff_hevc_decode_nal_vps(HEVCContext *s)
--
GitLab