From 63a37d0e1ec59377af9fb7973ffc847f928ba851 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 3 Nov 2013 02:07:31 +0100 Subject: [PATCH] avcodec/hevc_sei: check active_seq_parameter_set_id validity Signed-off-by: Michael Niedermayer --- libavcodec/hevc_sei.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c index ecccc692bd..a6a5dfc28b 100644 --- a/libavcodec/hevc_sei.c +++ b/libavcodec/hevc_sei.c @@ -99,21 +99,29 @@ static int decode_pic_timing(HEVCContext *s) return 1; } -static void active_parameter_sets(HEVCContext *s) +static int active_parameter_sets(HEVCContext *s) { GetBitContext *gb = &s->HEVClc->gb; int num_sps_ids_minus1; int i; + unsigned active_seq_parameter_set_id; get_bits(gb, 4); // active_video_parameter_set_id get_bits(gb, 1); // self_contained_cvs_flag get_bits(gb, 1); // num_sps_ids_minus1 num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1 - s->active_seq_parameter_set_id = get_ue_golomb_long(gb); + active_seq_parameter_set_id = get_ue_golomb_long(gb); + if (active_seq_parameter_set_id >= MAX_SPS_COUNT) { + av_log(s->avctx, AV_LOG_ERROR, "active_parameter_set_id %d invalid\n", active_seq_parameter_set_id); + return AVERROR_INVALIDDATA; + } + s->active_seq_parameter_set_id = active_seq_parameter_set_id; for (i = 1; i <= num_sps_ids_minus1; i++) get_ue_golomb_long(gb); // active_seq_parameter_set_id[i] + + return 0; } static int decode_nal_sei_message(HEVCContext *s)