stv0g/tvheadend
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Avoid SPS and PPS id array out of bounds in h264 parser

Browse source 
Fixes ticket #467
This commit is contained in:
Andreas Öman 2011-05-18 11:43:18 +02:00
parent e9d2c111af
commit 828137904e
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/parser_h264.c
View file

@ -239,6 +239,8 @@ h264_decode_seq_parameter_set(elementary_stream_t *st, bitstream_t *bs)
level_idc= read_bits(bs, 8);
sps_id= read_golomb_ue(bs);
if(sps_id > 255)
return -1;
i = 0;
while(h264_lev2cpbsize[i][0] != -1) {
@ -337,7 +339,12 @@ h264_decode_pic_parameter_set(elementary_stream_t *st, bitstream_t *bs)
p = st->es_priv = calloc(1, sizeof(h264_private_t));
pps_id = read_golomb_ue(bs);
if(pps_id > 255)
return 0;
sps_id = read_golomb_ue(bs);
if(sps_id > 255)
return -1;
p->pps[pps_id].sps = sps_id;
return 0;
}
@ -374,6 +381,9 @@ h264_decode_slice_header(elementary_stream_t *st, bitstream_t *bs, int *pkttype,
}
pps_id = read_golomb_ue(bs);
if(pps_id > 255)
return -1;
sps_id = p->pps[pps_id].sps;
if(p->sps[sps_id].max_frame_num_bits == 0)
return -1;