avcodec/hevc: check slice_header_extension data length
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 12 Jul 2014 03:07:16 +0000 (05:07 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 12 Jul 2014 05:46:07 +0000 (07:46 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/hevc.c

index 8ae8fc7..a64c627 100644 (file)
@@ -708,6 +708,10 @@ static int hls_slice_header(HEVCContext *s)
 
     if (s->pps->slice_header_extension_present_flag) {
         unsigned int length = get_ue_golomb_long(gb);
+        if (length*8LL > get_bits_left(gb)) {
+            av_log(s->avctx, AV_LOG_ERROR, "too many slice_header_extension_data_bytes\n");
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < length; i++)
             skip_bits(gb, 8);  // slice_header_extension_data_byte
     }