generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

h264: check ref_count validity for num_ref_idx_active_override_flag

Browse Source 
Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
CC: libav-stable@libav.org
(cherry-picked from commit 6e5cdf26281945ddea3aaf5eca4d127791f23ca8)
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
This commit is contained in:
Janne Grunau 2013-01-12 17:22:50 +01:00 committed by Reinhard Tartler
parent 06312bbb10
commit adef01c370
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/h264.c
View File

@ -3121,8 +3121,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
if(num_ref_idx_active_override_flag){
h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
if(h->slice_type_nos==AV_PICTURE_TYPE_B)
if (h->ref_count[0] < 1)
return AVERROR_INVALIDDATA;
if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
if (h->ref_count[1] < 1)
return AVERROR_INVALIDDATA;
}
}
if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) {