repositories
/
deb_ffmpeg.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Imported Debian version 2.5.0~trusty1.1
[deb_ffmpeg.git]
/
ffmpeg
/
libavcodec
/
hevc_ps.c
diff --git
a/ffmpeg/libavcodec/hevc_ps.c
b/ffmpeg/libavcodec/hevc_ps.c
index 4e1c56163d1983859cf03585fefad07abee1efee..6b5e13fc5bca731065a5245899b6a87686f5294b 100644
(file)
--- a/
ffmpeg/libavcodec/hevc_ps.c
+++ b/
ffmpeg/libavcodec/hevc_ps.c
@@
-951,6
+951,11
@@
int ff_hevc_decode_nal_sps(HEVCContext *s)
sps->long_term_ref_pics_present_flag = get_bits1(gb);
if (sps->long_term_ref_pics_present_flag) {
sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
sps->long_term_ref_pics_present_flag = get_bits1(gb);
if (sps->long_term_ref_pics_present_flag) {
sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
+ if (sps->num_long_term_ref_pics_sps > 31U) {
+ av_log(0, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
+ sps->num_long_term_ref_pics_sps);
+ goto err;
+ }
for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
sps->lt_ref_pic_poc_lsb_sps[i] = get_bits(gb, sps->log2_max_poc_lsb);
sps->used_by_curr_pic_lt_sps_flag[i] = get_bits1(gb);
for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
sps->lt_ref_pic_poc_lsb_sps[i] = get_bits(gb, sps->log2_max_poc_lsb);
sps->used_by_curr_pic_lt_sps_flag[i] = get_bits1(gb);
@@
-1025,10
+1030,8
@@
int ff_hevc_decode_nal_sps(HEVCContext *s)
}
av_log(s->avctx, AV_LOG_WARNING,
"Displaying the whole video surface.\n");
}
av_log(s->avctx, AV_LOG_WARNING,
"Displaying the whole video surface.\n");
- sps->pic_conf_win.left_offset =
- sps->pic_conf_win.right_offset =
- sps->pic_conf_win.top_offset =
- sps->pic_conf_win.bottom_offset = 0;
+ memset(&sps->pic_conf_win, 0, sizeof(sps->pic_conf_win));
+ memset(&sps->output_window, 0, sizeof(sps->output_window));
sps->output_width = sps->width;
sps->output_height = sps->height;
}
sps->output_width = sps->width;
sps->output_height = sps->height;
}
@@
-1375,7
+1378,8
@@
int ff_hevc_decode_nal_pps(HEVCContext *s)
int pps_range_extensions_flag = get_bits1(gb);
/* int pps_extension_7bits = */ get_bits(gb, 7);
if (sps->ptl.general_ptl.profile_idc == FF_PROFILE_HEVC_REXT && pps_range_extensions_flag) {
int pps_range_extensions_flag = get_bits1(gb);
/* int pps_extension_7bits = */ get_bits(gb, 7);
if (sps->ptl.general_ptl.profile_idc == FF_PROFILE_HEVC_REXT && pps_range_extensions_flag) {
- pps_range_extensions(s, pps, sps);
+ if ((ret = pps_range_extensions(s, pps, sps)) < 0)
+ goto err;
}
}
}
}