[FFmpeg-cvslog] avcodec/hevc_ps: Check vps_num_hrd_parameters

[Michael Niedermayer]

ffmpeg | branch: release/2.6 | Michael Niedermayer <michaelni at gmx.at> | Wed May 13 13:35:57 2015 +0200| [e8784ec5f5e829892f185e80c177bc8a9e93e344] | committer: Michael Niedermayer

avcodec/hevc_ps: Check vps_num_hrd_parameters

Fix CID1239052 part2

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit b195aa5d529040f43ab3acf0079cecbeb111bd57)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e8784ec5f5e829892f185e80c177bc8a9e93e344
---

 libavcodec/hevc_ps.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index ffd65c4..38d99cf 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -442,6 +442,11 @@ int ff_hevc_decode_nal_vps(HEVCContext *s)
         if (vps->vps_poc_proportional_to_timing_flag)
             vps->vps_num_ticks_poc_diff_one = get_ue_golomb_long(gb) + 1;
         vps->vps_num_hrd_parameters = get_ue_golomb_long(gb);
+        if (vps->vps_num_hrd_parameters > (unsigned)vps->vps_num_layer_sets) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "vps_num_hrd_parameters %d is invalid\n", vps->vps_num_hrd_parameters);
+            goto err;
+        }
         for (i = 0; i < vps->vps_num_hrd_parameters; i++) {
             int common_inf_present = 1;