[FFmpeg-cvslog] avcodec/hevc_ps: Check vps_num_hrd_parameters

[Michael Niedermayer]

ffmpeg | branch: release/2.2 | Michael Niedermayer <michaelni at gmx.at> | Wed May 13 13:35:57 2015 +0200| [a2e183aa0552753af91559303229dfd5ebc61ed1] | committer: Michael Niedermayer

avcodec/hevc_ps: Check vps_num_hrd_parameters

Fix CID1239052 part2

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit b195aa5d529040f43ab3acf0079cecbeb111bd57)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a2e183aa0552753af91559303229dfd5ebc61ed1
---

 libavcodec/hevc_ps.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 2dad58d..85d1213 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -396,6 +396,11 @@ int ff_hevc_decode_nal_vps(HEVCContext *s)
         if (vps->vps_poc_proportional_to_timing_flag)
             vps->vps_num_ticks_poc_diff_one = get_ue_golomb_long(gb) + 1;
         vps->vps_num_hrd_parameters = get_ue_golomb_long(gb);
+        if (vps->vps_num_hrd_parameters > (unsigned)vps->vps_num_layer_sets) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "vps_num_hrd_parameters %d is invalid\n", vps->vps_num_hrd_parameters);
+            goto err;
+        }
         for (i = 0; i < vps->vps_num_hrd_parameters; i++) {
             int common_inf_present = 1;