diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 13:21:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-21 20:43:38 +0200 |
| commit | 58f310f4966950e6abb7567230187669ae961122 (patch) | |
| tree | 7760d25980347b09fbcdc526d51ce1f71cdd7d35 | |
| parent | 0230a8efc6c9d505dc4be36e2909d9230b0813a9 (diff) | |
| download | ffmpeg-58f310f4966950e6abb7567230187669ae961122.tar.gz | |
avcodec/hevc: Check num_entry_point_offsets
Fixes CID1239099 part 2
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hevc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index aec1f1bf55..2ba70ac345 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -674,7 +674,14 @@ static int hls_slice_header(HEVCContext *s) sh->num_entry_point_offsets = 0; if (s->pps->tiles_enabled_flag || s->pps->entropy_coding_sync_enabled_flag) { - sh->num_entry_point_offsets = get_ue_golomb_long(gb); + unsigned num_entry_point_offsets = get_ue_golomb_long(gb); + // It would be possible to bound this tighter but this here is simpler + if (sh->num_entry_point_offsets > get_bits_left(gb)) { + av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets); + return AVERROR_INVALIDDATA; + } + + sh->num_entry_point_offsets = num_entry_point_offsets; if (sh->num_entry_point_offsets > 0) { int offset_len = get_ue_golomb_long(gb) + 1; int segments = offset_len >> 4; |