mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-09-07 16:40:10 +02:00
avcodec/h264_slice: Check idr_pic_id
Fixes: left shift of negative value -1 Fixes: 39223/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5498831521841152 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
d88d0370d5
commit
f054871a65
@ -1911,8 +1911,13 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
|
|||||||
sl->max_pic_num = 1 << (sps->log2_max_frame_num + 1);
|
sl->max_pic_num = 1 << (sps->log2_max_frame_num + 1);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (nal->type == H264_NAL_IDR_SLICE)
|
if (nal->type == H264_NAL_IDR_SLICE) {
|
||||||
sl->idr_pic_id = get_ue_golomb_long(&sl->gb);
|
unsigned idr_pic_id = get_ue_golomb_long(&sl->gb);
|
||||||
|
if (idr_pic_id < 65536) {
|
||||||
|
sl->idr_pic_id = idr_pic_id;
|
||||||
|
} else
|
||||||
|
av_log(h->avctx, AV_LOG_WARNING, "idr_pic_id is invalid\n");
|
||||||
|
}
|
||||||
|
|
||||||
sl->poc_lsb = 0;
|
sl->poc_lsb = 0;
|
||||||
sl->delta_poc_bottom = 0;
|
sl->delta_poc_bottom = 0;
|
||||||
|
Loading…
Reference in New Issue
Block a user