[FFmpeg-cvslog] h264: More correct ref_count check in decode_slice_header()
Michael Niedermayer
git at videolan.org
Wed Sep 28 22:32:38 CEST 2011
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Sep 28 22:22:56 2011 +0200| [dc9ce40069bde3d28f8d0b3e5bd733ae255fecb5] | committer: Michael Niedermayer
h264: More correct ref_count check in decode_slice_header()
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc9ce40069bde3d28f8d0b3e5bd733ae255fecb5
---
libavcodec/h264.c | 11 ++++++-----
1 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 5e9d58c..2ea141e 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2881,6 +2881,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
h->ref_count[1]= h->pps.ref_count[1];
if(h->slice_type_nos != AV_PICTURE_TYPE_I){
+ unsigned max= (16<<(s->picture_structure != PICT_FRAME))-1;
if(h->slice_type_nos == AV_PICTURE_TYPE_B){
h->direct_spatial_mv_pred= get_bits1(&s->gb);
}
@@ -2891,11 +2892,11 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
if(h->slice_type_nos==AV_PICTURE_TYPE_B)
h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
- if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){
- av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
- h->ref_count[0]= h->ref_count[1]= 1;
- return -1;
- }
+ }
+ if(h->ref_count[0]-1 > max || h->ref_count[1]-1 > max){
+ av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n");
+ h->ref_count[0]= h->ref_count[1]= 1;
+ return -1;
}
if(h->slice_type_nos == AV_PICTURE_TYPE_B)
h->list_count= 2;
More information about the ffmpeg-cvslog
mailing list