diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-06 02:44:21 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-06 02:44:21 +0200 |
| commit | a2190de52d6c519021e81a21f5e70598fe1c9f8a (patch) | |
| tree | 3d85448e268ad194bc273813b34b059e3318da82 /libavcodec | |
| parent | d93181ef3eacdb862d93448f31c97765a523d1db (diff) | |
| download | ffmpeg-a2190de52d6c519021e81a21f5e70598fe1c9f8a.tar.gz | |
avcodec/diracdec: Fix types and wraparounds in dirac_decode_picture_header()
previously various variables had a too small type to support the required 32bit unsigned
range allowed from the spec
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/diracdec.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index bb0f2c77d9..d452982d02 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1705,8 +1705,9 @@ static int get_buffer_with_edge(AVCodecContext *avctx, AVFrame *f, int flags) */ static int dirac_decode_picture_header(DiracContext *s) { - int retire, picnum; - int i, j, refnum, refdist; + unsigned retire, picnum; + int i, j; + int64_t refdist, refnum; GetBitContext *gb = &s->gb; /* [DIRAC_STD] 11.1.1 Picture Header. picture_header() PICTURE_NUM */ @@ -1722,8 +1723,8 @@ static int dirac_decode_picture_header(DiracContext *s) s->ref_pics[0] = s->ref_pics[1] = NULL; for (i = 0; i < s->num_refs; i++) { - refnum = picnum + dirac_get_se_golomb(gb); - refdist = INT_MAX; + refnum = (picnum + dirac_get_se_golomb(gb)) & 0xFFFFFFFF; + refdist = INT64_MAX; /* find the closest reference to the one we want */ /* Jordi: this is needed if the referenced picture hasn't yet arrived */ @@ -1755,7 +1756,7 @@ static int dirac_decode_picture_header(DiracContext *s) /* retire the reference frames that are not used anymore */ if (s->current_picture->avframe->reference) { - retire = picnum + dirac_get_se_golomb(gb); + retire = (picnum + dirac_get_se_golomb(gb)) & 0xFFFFFFFF; if (retire != picnum) { DiracFrame *retire_pic = remove_frame(s->ref_frames, retire); |