diff options
| author | Janne Grunau <janne-libav@jannau.net> | 2012-11-25 12:56:04 +0100 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2012-12-07 11:43:28 +0100 |
| commit | d7d6efe42b0d2057e67999b96b9a391f533d2333 (patch) | |
| tree | 5846f2c181d2d2cd756021942e804f8565fab5d3 /libavcodec/h264_ps.c | |
| parent | 8cc2fa1e5db0655c053b35c948ef05ba0fe13707 (diff) | |
h264: check sps.log2_max_frame_num for validity
Fixes infinite or long taking loop in frame num gap code in
the fuzzed sample bipbop234.ts_s223302.
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/h264_ps.c')
| -rw-r--r-- | libavcodec/h264_ps.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 7d9d59664f..7555daacb6 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -37,6 +37,9 @@ //#undef NDEBUG #include <assert.h> +#define MAX_LOG2_MAX_FRAME_NUM (12 + 4) +#define MIN_LOG2_MAX_FRAME_NUM 4 + static const AVRational pixel_aspect[17]={ {0, 1}, {1, 1}, @@ -301,7 +304,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ MpegEncContext * const s = &h->s; int profile_idc, level_idc, constraint_set_flags = 0; unsigned int sps_id; - int i; + int i, log2_max_frame_num_minus4; SPS *sps; profile_idc= get_bits(&s->gb, 8); @@ -348,7 +351,16 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ sps->bit_depth_chroma = 8; } - sps->log2_max_frame_num= get_ue_golomb(&s->gb) + 4; + log2_max_frame_num_minus4 = get_ue_golomb(&s->gb); + if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 || + log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) { + av_log(h->s.avctx, AV_LOG_ERROR, + "log2_max_frame_num_minus4 out of range (0-12): %d\n", + log2_max_frame_num_minus4); + return AVERROR_INVALIDDATA; + } + sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4; + sps->poc_type= get_ue_golomb_31(&s->gb); if(sps->poc_type == 0){ //FIXME #define |