mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/hevc_ps: Check abs_delta_rps
Fixes integer overflow Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
ba80b8d29b
commit
d13a731fc1
|
@ -87,7 +87,8 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps,
|
||||||
|
|
||||||
if (rps_predict) {
|
if (rps_predict) {
|
||||||
const ShortTermRPS *rps_ridx;
|
const ShortTermRPS *rps_ridx;
|
||||||
int delta_rps, abs_delta_rps;
|
int delta_rps;
|
||||||
|
unsigned abs_delta_rps;
|
||||||
uint8_t use_delta_flag = 0;
|
uint8_t use_delta_flag = 0;
|
||||||
uint8_t delta_rps_sign;
|
uint8_t delta_rps_sign;
|
||||||
|
|
||||||
|
@ -105,6 +106,12 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps,
|
||||||
|
|
||||||
delta_rps_sign = get_bits1(gb);
|
delta_rps_sign = get_bits1(gb);
|
||||||
abs_delta_rps = get_ue_golomb_long(gb) + 1;
|
abs_delta_rps = get_ue_golomb_long(gb) + 1;
|
||||||
|
if (abs_delta_rps < 1 || abs_delta_rps > 32768) {
|
||||||
|
av_log(s->avctx, AV_LOG_ERROR,
|
||||||
|
"Invalid value of abs_delta_rps: %d\n",
|
||||||
|
abs_delta_rps);
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
delta_rps = (1 - (delta_rps_sign << 1)) * abs_delta_rps;
|
delta_rps = (1 - (delta_rps_sign << 1)) * abs_delta_rps;
|
||||||
for (i = 0; i <= rps_ridx->num_delta_pocs; i++) {
|
for (i = 0; i <= rps_ridx->num_delta_pocs; i++) {
|
||||||
int used = rps->used[k] = get_bits1(gb);
|
int used = rps->used[k] = get_bits1(gb);
|
||||||
|
|
Loading…
Reference in New Issue