[FFmpeg-cvslog] r11215 - trunk/libavcodec/h264.c

[heydowns]

Author: heydowns
Date: Fri Dec 14 06:48:27 2007
New Revision: 11215

Log:
Actually return with an error condition if we're being asked to deal with too
many reference frames. Also check max num ref frames against our internal
ref buffer sizes.
Part of fix for roundup issue 281


Modified:
   trunk/libavcodec/h264.c

Modified: trunk/libavcodec/h264.c
==============================================================================
--- trunk/libavcodec/h264.c	(original)
+++ trunk/libavcodec/h264.c	Fri Dec 14 06:48:27 2007
@@ -7210,8 +7210,9 @@ static inline int decode_seq_parameter_s
     }
 
     tmp= get_ue_golomb(&s->gb);
-    if(tmp > MAX_PICTURE_COUNT-2){
+    if(tmp > MAX_PICTURE_COUNT-2 || tmp >= 32){
         av_log(h->s.avctx, AV_LOG_ERROR, "too many reference frames\n");
+        return -1;
     }
     sps->ref_frame_count= tmp;
     sps->gaps_in_frame_num_allowed_flag= get_bits1(&s->gb);