Commit d7d6efe4 authored by Janne Grunau's avatar Janne Grunau
Browse files

h264: check sps.log2_max_frame_num for validity

Fixes infinite or long taking loop in frame num gap code in
the fuzzed sample bipbop234.ts_s223302.

CC: libav-stable@libav.org
parent 8cc2fa1e
......@@ -37,6 +37,9 @@
//#undef NDEBUG
#include <assert.h>
#define MAX_LOG2_MAX_FRAME_NUM (12 + 4)
#define MIN_LOG2_MAX_FRAME_NUM 4
static const AVRational pixel_aspect[17]={
{0, 1},
{1, 1},
......@@ -301,7 +304,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
MpegEncContext * const s = &h->s;
int profile_idc, level_idc, constraint_set_flags = 0;
unsigned int sps_id;
int i;
int i, log2_max_frame_num_minus4;
SPS *sps;
profile_idc= get_bits(&s->gb, 8);
......@@ -348,7 +351,16 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
sps->bit_depth_chroma = 8;
}
sps->log2_max_frame_num= get_ue_golomb(&s->gb) + 4;
log2_max_frame_num_minus4 = get_ue_golomb(&s->gb);
if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 ||
log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) {
av_log(h->s.avctx, AV_LOG_ERROR,
"log2_max_frame_num_minus4 out of range (0-12): %d\n",
log2_max_frame_num_minus4);
return AVERROR_INVALIDDATA;
}
sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4;
sps->poc_type= get_ue_golomb_31(&s->gb);
if(sps->poc_type == 0){ //FIXME #define
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment