diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-18 16:29:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-03 20:45:41 +0100 |
| commit | c82d6e05da0898c45ae915fb808e175f6a4ec7e5 (patch) | |
| tree | 33a6c87b667b478d3d7e94dd4d4f1937af86902e | |
| parent | c8833a13cf530fbf5b1d579cd1ae527a0904403f (diff) | |
| download | ffmpeg-c82d6e05da0898c45ae915fb808e175f6a4ec7e5.tar.gz | |
h264: correct ref count check and limit, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d6c184880ee2e09fd68c0ae217173832cee5afc1)
| -rw-r--r-- | libavcodec/h264.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 713fda7421..ec3afea932 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2922,7 +2922,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0) h->ref_count[1] = get_ue_golomb(&s->gb) + 1; else // full range is spec-ok in this case, even for frames - max[1] = 31; + h->ref_count[1] = 1; } if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){ |