diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-09-28 22:22:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-28 23:36:39 +0200 |
| commit | be9183de2ec54aab2f3e613b53ead369b6cf22fe (patch) | |
| tree | a7b3f007d88a3d0ab09b17b0760cce88e6d797eb | |
| parent | 9960710b872e2d1c7d9d8730c4b6ca2c2cdf183e (diff) | |
| download | ffmpeg-be9183de2ec54aab2f3e613b53ead369b6cf22fe.tar.gz | |
h264: More correct ref_count check in decode_slice_header()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit dc9ce40069bde3d28f8d0b3e5bd733ae255fecb5)
| -rw-r--r-- | libavcodec/h264.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index f227ddfedf..b844c38b56 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2872,6 +2872,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ h->ref_count[1]= h->pps.ref_count[1]; if(h->slice_type_nos != AV_PICTURE_TYPE_I){ + unsigned max= (16<<(s->picture_structure != PICT_FRAME))-1; if(h->slice_type_nos == AV_PICTURE_TYPE_B){ h->direct_spatial_mv_pred= get_bits1(&s->gb); } @@ -2882,11 +2883,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ if(h->slice_type_nos==AV_PICTURE_TYPE_B) h->ref_count[1]= get_ue_golomb(&s->gb) + 1; - if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){ - av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n"); - h->ref_count[0]= h->ref_count[1]= 1; - return -1; - } + } + if(h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){ + av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n"); + h->ref_count[0]= h->ref_count[1]= 1; + return -1; } if(h->slice_type_nos == AV_PICTURE_TYPE_B) h->list_count= 2; |