avcodec/hevc: fix nb_sh / nb_sps check

fixes integer overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-07-12 04:39:01 +02:00
parent ca671beead
commit c79acacd2e

View File

@ -243,7 +243,7 @@ static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb)
nb_sps = get_ue_golomb_long(gb); nb_sps = get_ue_golomb_long(gb);
nb_sh = get_ue_golomb_long(gb); nb_sh = get_ue_golomb_long(gb);
if (nb_sh + nb_sps > FF_ARRAY_ELEMS(rps->poc)) if (nb_sh + (uint64_t)nb_sps > FF_ARRAY_ELEMS(rps->poc))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
rps->nb_refs = nb_sh + nb_sps; rps->nb_refs = nb_sh + nb_sps;