diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-07-12 05:15:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-07-12 07:46:08 +0200 |
| commit | 66558fe715bf284467d13971a57ed492aa61bff4 (patch) | |
| tree | a52c184b5d2221e2417cbaa4b85a192e181267f0 /libavcodec/hevc_ps.c | |
| parent | 6935ae22ed818011cedb61b2d2aabdc01ceb991f (diff) | |
| download | ffmpeg-66558fe715bf284467d13971a57ed492aa61bff4.tar.gz | |
avcodec/hevc_ps: Check layer_id_included_flags count
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/hevc_ps.c')
| -rw-r--r-- | libavcodec/hevc_ps.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c index ffc993183d..ee2c0ae6f4 100644 --- a/libavcodec/hevc_ps.c +++ b/libavcodec/hevc_ps.c @@ -385,6 +385,11 @@ int ff_hevc_decode_nal_vps(HEVCContext *s) vps->vps_max_layer_id = get_bits(gb, 6); vps->vps_num_layer_sets = get_ue_golomb_long(gb) + 1; + if ((vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) { + av_log(s->avctx, AV_LOG_ERROR, "too many layer_id_included_flags\n"); + goto err; + } + for (i = 1; i < vps->vps_num_layer_sets; i++) for (j = 0; j <= vps->vps_max_layer_id; j++) skip_bits(gb, 1); // layer_id_included_flag[i][j] |