diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2014-07-19 19:29:46 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2014-07-19 19:30:44 +0400 |
commit | d13a731fc149d3fdbe679078479ec1950674e762 (patch) | |
tree | bbc20dbe1cfdf3d6242a84b998871730fa464100 /libavcodec/hevc_ps.c | |
parent | ba80b8d29b2adc7fd74324c9bd50cd0be7ab2c21 (diff) |
avcodec/hevc_ps: Check abs_delta_rps
Fixes integer overflow
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/hevc_ps.c')
-rw-r--r-- | libavcodec/hevc_ps.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 189b3d6b5c..166e55567b 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -87,7 +87,8 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps, if (rps_predict) { const ShortTermRPS *rps_ridx; - int delta_rps, abs_delta_rps; + int delta_rps; + unsigned abs_delta_rps; uint8_t use_delta_flag = 0; uint8_t delta_rps_sign; @@ -105,6 +106,12 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps, delta_rps_sign = get_bits1(gb); abs_delta_rps = get_ue_golomb_long(gb) + 1; + if (abs_delta_rps < 1 || abs_delta_rps > 32768) { + av_log(s->avctx, AV_LOG_ERROR, + "Invalid value of abs_delta_rps: %d\n", + abs_delta_rps); + return AVERROR_INVALIDDATA; + } delta_rps = (1 - (delta_rps_sign << 1)) * abs_delta_rps; for (i = 0; i <= rps_ridx->num_delta_pocs; i++) { int used = rps->used[k] = get_bits1(gb); |