mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-09-06 16:10:09 +02:00
avcodec/hevc_ps: Check abs_delta_rps
Fixes integer overflow Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
ba80b8d29b
commit
d13a731fc1
@ -87,7 +87,8 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps,
|
||||
|
||||
if (rps_predict) {
|
||||
const ShortTermRPS *rps_ridx;
|
||||
int delta_rps, abs_delta_rps;
|
||||
int delta_rps;
|
||||
unsigned abs_delta_rps;
|
||||
uint8_t use_delta_flag = 0;
|
||||
uint8_t delta_rps_sign;
|
||||
|
||||
@ -105,6 +106,12 @@ int ff_hevc_decode_short_term_rps(HEVCContext *s, ShortTermRPS *rps,
|
||||
|
||||
delta_rps_sign = get_bits1(gb);
|
||||
abs_delta_rps = get_ue_golomb_long(gb) + 1;
|
||||
if (abs_delta_rps < 1 || abs_delta_rps > 32768) {
|
||||
av_log(s->avctx, AV_LOG_ERROR,
|
||||
"Invalid value of abs_delta_rps: %d\n",
|
||||
abs_delta_rps);
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
delta_rps = (1 - (delta_rps_sign << 1)) * abs_delta_rps;
|
||||
for (i = 0; i <= rps_ridx->num_delta_pocs; i++) {
|
||||
int used = rps->used[k] = get_bits1(gb);
|
||||
|
Loading…
Reference in New Issue
Block a user