aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec
diff options
context:
space:
mode:
authorJanne Grunau <janne-libav@jannau.net>2013-01-12 17:22:50 +0100
committerReinhard Tartler <siretart@tauware.de>2013-01-12 19:36:38 +0100
commitdd0c5e0fa909bac905ea8baa49b704892792a1c9 (patch)
tree705c250cb8d033d65b4548ef8ce03acf43927cf4 /libavcodec
parentad025377462cd01c11f1fe67d087804999af9d49 (diff)
downloadffmpeg-dd0c5e0fa909bac905ea8baa49b704892792a1c9.tar.gz
h264: check ref_count validity for num_ref_idx_active_override_flag
Fixes segfault in the fuzzed sample bipbop234.ts_s226407. CC: libav-stable@libav.org (cherry-picked from commit 6e5cdf26281945ddea3aaf5eca4d127791f23ca8) Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Diffstat (limited to 'libavcodec')
-rw-r--r--libavcodec/h264.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 1f85eea24d..739b9d2e51 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2890,8 +2890,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
if(num_ref_idx_active_override_flag){
h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
- if(h->slice_type_nos==AV_PICTURE_TYPE_B)
+ if (h->ref_count[0] < 1)
+ return AVERROR_INVALIDDATA;
+ if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
+ if (h->ref_count[1] < 1)
+ return AVERROR_INVALIDDATA;
+ }
}
if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) {