diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-18 19:29:04 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-18 19:47:29 +0400 |
| commit | d6c184880ee2e09fd68c0ae217173832cee5afc1 (patch) | |
| tree | 50c6f76f0899fc8978b2298c06b9c85e20c5f8e1 /libavcodec | |
| parent | 2d5f1addbec2a1184b4e3b56dbfcb5416401a44f (diff) | |
h264: correct ref count check and limit, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/h264.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index da43f1e457..32cede5eea 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2935,7 +2935,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0) h->ref_count[1] = get_ue_golomb(&s->gb) + 1; else // full range is spec-ok in this case, even for frames - max[1] = 31; + h->ref_count[1] = 1; } if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){ |