diff options
Diffstat (limited to 'gst-libs/ext/libav/libavcodec/h264_ps.c')
| -rw-r--r-- | gst-libs/ext/libav/libavcodec/h264_ps.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/gst-libs/ext/libav/libavcodec/h264_ps.c b/gst-libs/ext/libav/libavcodec/h264_ps.c index 76bf116..ff6103c 100644 --- a/gst-libs/ext/libav/libavcodec/h264_ps.c +++ b/gst-libs/ext/libav/libavcodec/h264_ps.c @@ -227,8 +227,7 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){ sps->num_reorder_frames= get_ue_golomb(&s->gb); get_ue_golomb(&s->gb); /*max_dec_frame_buffering*/ - if(s->gb.size_in_bits < get_bits_count(&s->gb)){ - av_log(h->s.avctx, AV_LOG_ERROR, "Overread VUI by %d bits\n", get_bits_count(&s->gb) - s->gb.size_in_bits); + if (get_bits_left(&s->gb) < 0) { sps->num_reorder_frames=0; sps->bitstream_restriction_flag= 0; } @@ -238,6 +237,10 @@ static inline int decode_vui_parameters(H264Context *h, SPS *sps){ return -1; } } + if (get_bits_left(&s->gb) < 0) { + av_log(h->s.avctx, AV_LOG_ERROR, "Overread VUI by %d bits\n", -get_bits_left(&s->gb)); + return AVERROR_INVALIDDATA; + } return 0; } @@ -329,8 +332,12 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ if(sps->profile_idc >= 100){ //high profile sps->chroma_format_idc= get_ue_golomb_31(&s->gb); - if(sps->chroma_format_idc == 3) + if(sps->chroma_format_idc > 3) { + av_log(h->s.avctx, AV_LOG_ERROR, "chroma_format_idc (%u) out of range\n", sps->chroma_format_idc); + return -1; + } else if(sps->chroma_format_idc == 3) { sps->residual_color_transform_flag = get_bits1(&s->gb); + } sps->bit_depth_luma = get_ue_golomb(&s->gb) + 8; sps->bit_depth_chroma = get_ue_golomb(&s->gb) + 8; sps->transform_bypass = get_bits1(&s->gb); @@ -468,6 +475,9 @@ int ff_h264_decode_picture_parameter_set(H264Context *h, int bit_length){ if(pps_id >= MAX_PPS_COUNT) { av_log(h->s.avctx, AV_LOG_ERROR, "pps_id (%d) out of range\n", pps_id); return -1; + } else if (h->sps.bit_depth_luma > 10) { + av_log(h->s.avctx, AV_LOG_ERROR, "Unimplemented luma bit depth=%d (max=10)\n", h->sps.bit_depth_luma); + return AVERROR_PATCHWELCOME; } pps= av_mallocz(sizeof(PPS)); |