virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/hevcdec: further constrain some slice header field values

Browse Source 
num_ref_idx_l0_active_minus1, num_ref_idx_l1_active_minus1,
num_ref_idx_l0_default_active_minus1, and num_ref_idx_l1_default_active_minus1
are all in the range 0 to 14, inclusive.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2023-04-20 10:12:47 -03:00
parent 73ddcad990
commit 95a78c08c1
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/hevc_ps.c
View File

@ -1762,8 +1762,14 @@ int ff_hevc_decode_nal_pps(GetBitContext *gb, AVCodecContext *avctx,
pps->cabac_init_present_flag = get_bits1(gb);
pps->num_ref_idx_l0_default_active = get_ue_golomb_long(gb) + 1;
pps->num_ref_idx_l1_default_active = get_ue_golomb_long(gb) + 1;
pps->num_ref_idx_l0_default_active = get_ue_golomb_31(gb) + 1;
pps->num_ref_idx_l1_default_active = get_ue_golomb_31(gb) + 1;
if (pps->num_ref_idx_l0_default_active >= HEVC_MAX_REFS ||
pps->num_ref_idx_l1_default_active >= HEVC_MAX_REFS) {
av_log(avctx, AV_LOG_ERROR, "Too many default refs in PPS: %d/%d.\n",
pps->num_ref_idx_l0_default_active, pps->num_ref_idx_l1_default_active);
goto err;
}
pps->pic_init_qp_minus26 = get_se_golomb(gb);

6
libavcodec/hevcdec.c
View File

@ -773,11 +773,11 @@ static int hls_slice_header(HEVCContext *s)
sh->nb_refs[L1] = s->ps.pps->num_ref_idx_l1_default_active;
if (get_bits1(gb)) { // num_ref_idx_active_override_flag
sh->nb_refs[L0] = get_ue_golomb_long(gb) + 1;
sh->nb_refs[L0] = get_ue_golomb_31(gb) + 1;
if (sh->slice_type == HEVC_SLICE_B)
sh->nb_refs[L1] = get_ue_golomb_long(gb) + 1;
sh->nb_refs[L1] = get_ue_golomb_31(gb) + 1;
}
if (sh->nb_refs[L0] > HEVC_MAX_REFS || sh->nb_refs[L1] > HEVC_MAX_REFS) {
if (sh->nb_refs[L0] >= HEVC_MAX_REFS || sh->nb_refs[L1] >= HEVC_MAX_REFS) {
av_log(s->avctx, AV_LOG_ERROR, "Too many refs: %d/%d.\n",
sh->nb_refs[L0], sh->nb_refs[L1]);
return AVERROR_INVALIDDATA;