[FFmpeg-cvslog] avcodec/hevc_sei: check active_seq_parameter_set_id validity

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Nov  3 02:07:31 2013 +0100| [63a37d0e1ec59377af9fb7973ffc847f928ba851] | committer: Michael Niedermayer

avcodec/hevc_sei: check active_seq_parameter_set_id validity

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=63a37d0e1ec59377af9fb7973ffc847f928ba851
---

 libavcodec/hevc_sei.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c
index ecccc69..a6a5dfc 100644
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -99,21 +99,29 @@ static int decode_pic_timing(HEVCContext *s)
     return 1;
 }
 
-static void active_parameter_sets(HEVCContext *s)
+static int active_parameter_sets(HEVCContext *s)
 {
     GetBitContext *gb = &s->HEVClc->gb;
     int num_sps_ids_minus1;
     int i;
+    unsigned active_seq_parameter_set_id;
 
     get_bits(gb, 4); // active_video_parameter_set_id
     get_bits(gb, 1); // self_contained_cvs_flag
     get_bits(gb, 1); // num_sps_ids_minus1
     num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1
 
-    s->active_seq_parameter_set_id = get_ue_golomb_long(gb);
+    active_seq_parameter_set_id = get_ue_golomb_long(gb);
+    if (active_seq_parameter_set_id >= MAX_SPS_COUNT) {
+        av_log(s->avctx, AV_LOG_ERROR, "active_parameter_set_id %d invalid\n", active_seq_parameter_set_id);
+        return AVERROR_INVALIDDATA;
+    }
+    s->active_seq_parameter_set_id = active_seq_parameter_set_id;
 
     for (i = 1; i <= num_sps_ids_minus1; i++)
         get_ue_golomb_long(gb); // active_seq_parameter_set_id[i]
+
+    return 0;
 }
 
 static int decode_nal_sei_message(HEVCContext *s)