diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 13:35:37 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-15 10:04:51 +0200 |
| commit | 0a93dc83d26a3e49040e6005519ac9c415d97154 (patch) | |
| tree | 9f27302e0197934ae11aa8c963109ee2edf5899e | |
| parent | bced2ad1bd53bde54139161cc35b97b57a787732 (diff) | |
| download | ffmpeg-0a93dc83d26a3e49040e6005519ac9c415d97154.tar.gz | |
avcodec/hevc_ps: More completely check vps_num_layer_sets
Fixes CID1239052 part1
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 16c95b107365cdbfcde1945370b59fc7e17e0309)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hevc_ps.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index 075a4bd915..ffd65c47f6 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -424,7 +424,8 @@ int ff_hevc_decode_nal_vps(HEVCContext *s) vps->vps_max_layer_id = get_bits(gb, 6); vps->vps_num_layer_sets = get_ue_golomb_long(gb) + 1; - if ((vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) { + if (vps->vps_num_layer_sets < 1 || vps->vps_num_layer_sets > 1024 || + (vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) { av_log(s->avctx, AV_LOG_ERROR, "too many layer_id_included_flags\n"); goto err; } |