diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-13 13:21:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-15 10:04:51 +0200 |
| commit | bced2ad1bd53bde54139161cc35b97b57a787732 (patch) | |
| tree | dd6164642993a3a412a4ec7476aa4bfc2a1dd8d3 | |
| parent | fe22d0d7c6edaa91c092cfc3d67aa5ebb4d989c7 (diff) | |
| download | ffmpeg-bced2ad1bd53bde54139161cc35b97b57a787732.tar.gz | |
avcodec/hevc: Check num_entry_point_offsets
Fixes CID1239099 part 2
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1c6ae98d4a9ff9ea607df87908393eda4ebdf4e8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hevc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index dfc5616de7..63c5688172 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -694,7 +694,14 @@ static int hls_slice_header(HEVCContext *s) sh->num_entry_point_offsets = 0; if (s->pps->tiles_enabled_flag || s->pps->entropy_coding_sync_enabled_flag) { - sh->num_entry_point_offsets = get_ue_golomb_long(gb); + unsigned num_entry_point_offsets = get_ue_golomb_long(gb); + // It would be possible to bound this tighter but this here is simpler + if (sh->num_entry_point_offsets > get_bits_left(gb)) { + av_log(s->avctx, AV_LOG_ERROR, "num_entry_point_offsets %d is invalid\n", num_entry_point_offsets); + return AVERROR_INVALIDDATA; + } + + sh->num_entry_point_offsets = num_entry_point_offsets; if (sh->num_entry_point_offsets > 0) { int offset_len = get_ue_golomb_long(gb) + 1; int segments = offset_len >> 4; |