avcodec/ff_h264_decode_sei: Check SEI size
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 21 Jul 2013 14:38:47 +0000 (16:38 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 21 Jul 2013 15:57:15 +0000 (17:57 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h264_sei.c

index 3003080..5e4321f 100644 (file)
@@ -264,6 +264,11 @@ int ff_h264_decode_sei(H264Context *h){
         if(h->avctx->debug&FF_DEBUG_STARTCODE)
             av_log(h->avctx, AV_LOG_DEBUG, "SEI %d len:%d\n", type, size);
 
+        if (size > get_bits_left(&h->gb) / 8) {
+            av_log(h->avctx, AV_LOG_ERROR, "SEI truncated\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         switch(type){
         case SEI_TYPE_PIC_TIMING: // Picture timing SEI
             if(decode_picture_timing(h) < 0)