From d6c184880ee2e09fd68c0ae217173832cee5afc1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 18 Nov 2012 16:29:04 +0100 Subject: h264: correct ref count check and limit, fix out of array accesses. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/h264.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index da43f1e457..32cede5eea 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -2935,7 +2935,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0) h->ref_count[1] = get_ue_golomb(&s->gb) + 1; else // full range is spec-ok in this case, even for frames - max[1] = 31; + h->ref_count[1] = 1; } if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){ -- cgit v1.2.3