avcodec/hevc_ps: Check layer_id_included_flags count
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 12 Jul 2014 03:15:31 +0000 (05:15 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 12 Jul 2014 05:46:08 +0000 (07:46 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/hevc_ps.c

index ffc9931..ee2c0ae 100644 (file)
@@ -385,6 +385,11 @@ int ff_hevc_decode_nal_vps(HEVCContext *s)
 
     vps->vps_max_layer_id   = get_bits(gb, 6);
     vps->vps_num_layer_sets = get_ue_golomb_long(gb) + 1;
+    if ((vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) {
+        av_log(s->avctx, AV_LOG_ERROR, "too many layer_id_included_flags\n");
+        goto err;
+    }
+
     for (i = 1; i < vps->vps_num_layer_sets; i++)
         for (j = 0; j <= vps->vps_max_layer_id; j++)
             skip_bits(gb, 1);  // layer_id_included_flag[i][j]