aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJames Almer <jamrial@gmail.com>2019-02-10 17:41:38 -0300
committerJames Almer <jamrial@gmail.com>2019-02-10 21:02:06 -0300
commit33c8009773500fe969af9044a81ca6b18a17a83d (patch)
treef83fe9ef9dc1be9f446bd12d0c16b7c0ba5a3d88
parent74700e50bf7444930bfc12935bd3e17cd5f766c1 (diff)
downloadffmpeg-33c8009773500fe969af9044a81ca6b18a17a83d.tar.gz
avcodec/cbs_av1: don't call cbs_av1_read_trailing_bits() when no bits remain in the OBU
Reviewed-by: jkqxz Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit 3e8b8b6b509c8c37defd3a8c32883fa54bc00de8)
-rw-r--r--libavcodec/cbs_av1.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/cbs_av1.c b/libavcodec/cbs_av1.c
index 535139e703..4513287ef9 100644
--- a/libavcodec/cbs_av1.c
+++ b/libavcodec/cbs_av1.c
@@ -1071,8 +1071,12 @@ static int cbs_av1_read_unit(CodedBitstreamContext *ctx,
if (obu->obu_size > 0 &&
obu->header.obu_type != AV1_OBU_TILE_GROUP &&
obu->header.obu_type != AV1_OBU_FRAME) {
- err = cbs_av1_read_trailing_bits(ctx, &gbc,
- obu->obu_size * 8 + start_pos - end_pos);
+ int nb_bits = obu->obu_size * 8 + start_pos - end_pos;
+
+ if (nb_bits <= 0)
+ return AVERROR_INVALIDDATA;
+
+ err = cbs_av1_read_trailing_bits(ctx, &gbc, nb_bits);
if (err < 0)
return err;
}