Merge commit '1329c08ad6d2ddb304858f2972c67b508e8b0f0e'
authorJames Almer <jamrial@gmail.com>
Sat, 11 Nov 2017 03:36:22 +0000 (00:36 -0300)
committerJames Almer <jamrial@gmail.com>
Sat, 11 Nov 2017 03:36:22 +0000 (00:36 -0300)
* commit '1329c08ad6d2ddb304858f2972c67b508e8b0f0e':
  hevc: Validate the number of long term reference pictures

See ea38e5a6b75706477898eb1e6582d667dbb9946c

Merged-by: James Almer <jamrial@gmail.com>
1  2 
libavcodec/hevc_ps.c

@@@ -1075,10 -883,11 +1075,10 @@@ int ff_hevc_parse_sps(HEVCSPS *sps, Get
      sps->long_term_ref_pics_present_flag = get_bits1(gb);
      if (sps->long_term_ref_pics_present_flag) {
          sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
-         if (sps->num_long_term_ref_pics_sps > 31U) {
-             av_log(avctx, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
+         if (sps->num_long_term_ref_pics_sps > HEVC_MAX_LONG_TERM_REF_PICS) {
+             av_log(avctx, AV_LOG_ERROR, "Too many long term ref pics: %d.\n",
                     sps->num_long_term_ref_pics_sps);
 -            ret = AVERROR_INVALIDDATA;
 -            goto err;
 +            return AVERROR_INVALIDDATA;
          }
          for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
              sps->lt_ref_pic_poc_lsb_sps[i]       = get_bits(gb, sps->log2_max_poc_lsb);