diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-01-12 22:19:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-12 22:19:40 +0100 |
| commit | f9c9ee445f7cb46be1550fdf809626b997f814ac (patch) | |
| tree | 0048c563f1ee8b60fdc3cfd8611c4c550817e551 /libavcodec/h264_ps.c | |
| parent | c0cbf3af0188d06a11c74b3ab2402de1c248a76b (diff) | |
| parent | 8935e7474ada9f18e9c21ec3a0a1706040e7b3be (diff) | |
| download | ffmpeg-f9c9ee445f7cb46be1550fdf809626b997f814ac.tar.gz | |
Merge branch 'release/0.8' into release/0.7
* release/0.8:
shorten: Fix invalid free()
j2kdec: Fix crash in get_qcx
j2kdec: Check curtileno for validity
atrac3: Fix crash in tonal component decoding. Fixes Ticket780 Bug Found by: cosminamironesei
h264: check chroma_format_idc range. Fixes Ticket758 Bug found by: Diana Elena Muscalu
aacsbr: Fix memory corruption. Fixes Ticket760 and Ticket761 Bug Found by: Diana Elena Muscalu
j2kdec: Fix integer overflow leading to a segfault Fixes Ticket776 Bug found by: Diana Elena Muscalu
ws_snd1: Fix wrong samples count and crash.
lavfi: add missing check in avfilter_filter_samples()
Update Changelog for 0.7.4 release
Update RELEASE file for 0.7.4
swscale: fix crash in fast_bilinear code when compiled with -mred-zone.
vorbis: An additional defense in the Vorbis codec.
vorbisdec: Fix decoding bug with channel handling
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/h264_ps.c')
| -rw-r--r-- | libavcodec/h264_ps.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 89e2502e0d..680db1e5a6 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -342,6 +342,10 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ if(sps->profile_idc >= 100){ //high profile sps->chroma_format_idc= get_ue_golomb_31(&s->gb); + if (sps->chroma_format_idc > 3U) { + av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc %d is illegal\n", sps->chroma_format_idc); + goto fail; + } if(sps->chroma_format_idc == 3) sps->residual_color_transform_flag = get_bits1(&s->gb); sps->bit_depth_luma = get_ue_golomb(&s->gb) + 8; |