avcodec/hevc_ps: More completely check vps_num_layer_sets

Fixes CID1239052  part1

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-05-13 13:35:37 +02:00
parent 6679d5f29a
commit 16c95b1073

View File

@ -462,7 +462,8 @@ int ff_hevc_decode_nal_vps(HEVCContext *s)
vps->vps_max_layer_id = get_bits(gb, 6);
vps->vps_num_layer_sets = get_ue_golomb_long(gb) + 1;
if ((vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) {
if (vps->vps_num_layer_sets < 1 || vps->vps_num_layer_sets > 1024 ||
(vps->vps_num_layer_sets - 1LL) * (vps->vps_max_layer_id + 1LL) > get_bits_left(gb)) {
av_log(s->avctx, AV_LOG_ERROR, "too many layer_id_included_flags\n");
goto err;
}