aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2007-01-23 13:36:56 +0000
committerMichael Niedermayer <michaelni@gmx.at>2007-01-23 13:36:56 +0000
commit6f9ca74becb3ee09b8ff9823578c663d96c00272 (patch)
treef3861e73d26906207602a156352ab84e0fb693f3
parentbd31a388db70e4e65c652d6e4d91807a70017491 (diff)
downloadffmpeg-6f9ca74becb3ee09b8ff9823578c663d96c00272.tar.gz
check num_reorder_frames for validity
increase delayed_pic buffer size (one temporary is used and a terminating NULL is assumed by most code so it has to be 18 large) Originally committed as revision 7663 to svn://svn.ffmpeg.org/ffmpeg/trunk
-rw-r--r--libavcodec/h264.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 5a5621483d..4c2f6ac960 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -330,7 +330,7 @@ typedef struct H264Context{
Picture *long_ref[32];
Picture default_ref_list[2][32];
Picture ref_list[2][48]; ///< 0..15: frame refs, 16..47: mbaff field refs
- Picture *delayed_pic[16]; //FIXME size?
+ Picture *delayed_pic[18]; //FIXME size?
Picture *delayed_output_pic;
/**
@@ -7672,13 +7672,21 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){
sps->bitstream_restriction_flag = get_bits1(&s->gb);
if(sps->bitstream_restriction_flag){
+ unsigned int num_reorder_frames;
get_bits1(&s->gb); /* motion_vectors_over_pic_boundaries_flag */
get_ue_golomb(&s->gb); /* max_bytes_per_pic_denom */
get_ue_golomb(&s->gb); /* max_bits_per_mb_denom */
get_ue_golomb(&s->gb); /* log2_max_mv_length_horizontal */
get_ue_golomb(&s->gb); /* log2_max_mv_length_vertical */
- sps->num_reorder_frames = get_ue_golomb(&s->gb);
- get_ue_golomb(&s->gb); /* max_dec_frame_buffering */
+ num_reorder_frames= get_ue_golomb(&s->gb);
+ get_ue_golomb(&s->gb); /*max_dec_frame_buffering*/
+
+ if(num_reorder_frames > 16 /*max_dec_frame_buffering || max_dec_frame_buffering > 16*/){
+ av_log(h->s.avctx, AV_LOG_ERROR, "illegal num_reorder_frames %d\n", num_reorder_frames);
+ return -1;
+ }
+
+ sps->num_reorder_frames= num_reorder_frames;
}
return 0;