diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 13:21:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 14:26:17 +0200 |
| commit | 1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8 (patch) | |
| tree | f4d8e0a95526046746fc96606bd08994457be4df | |
| parent | 3e9d5e16ad9799f6b6faae4f21120d23146b84c9 (diff) | |
| download | ffmpeg-1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8.tar.gz | |
avcodec/hevc: Check num_entry_point_offsets
Fixes CID1239099 part 2
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hevc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index dc7cabb6d5..54cb341612 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -707,7 +707,14 @@ static int hls_slice_header(HEVCContext *s) sh->num_entry_point_offsets = 0; if (s->pps->tiles_enabled_flag || s->pps->entropy_coding_sync_enabled_flag) { - sh->num_entry_point_offsets = get_ue_golomb_long(gb); + unsigned num_entry_point_offsets = get_ue_golomb_long(gb); + // It would be possible to bound this tighter but this here is simpler + if (sh->num_entry_point_offsets > get_bits_left(gb)) { + av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets); + return AVERROR_INVALIDDATA; + } + + sh->num_entry_point_offsets = num_entry_point_offsets; if (sh->num_entry_point_offsets > 0) { int offset_len = get_ue_golomb_long(gb) + 1; int segments = offset_len >> 4; |