[libav-stable] [libav-commits] h264: check ref_count validity for num_ref_idx_active_override_flag

Reinhard Tartler siretart at gmail.com
Sat Jan 12 16:59:22 CET 2013


On Tue, Nov 27, 2012 at 12:41 PM, Janne Grunau <git at libav.org> wrote:
> Module: libav
> Branch: master
> Commit: 6e5cdf26281945ddea3aaf5eca4d127791f23ca8
>
> Author:    Janne Grunau <janne-libav at jannau.net>
> Committer: Janne Grunau <janne-libav at jannau.net>
> Date:      Sun Nov 25 16:02:02 2012 +0100
>
> h264: check ref_count validity for num_ref_idx_active_override_flag
>
> Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
>
> CC: libav-stable at libav.org
>
> ---
>
>  libavcodec/h264.c |    7 ++++++-
>  1 files changed, 6 insertions(+), 1 deletions(-)
>
> diff --git a/libavcodec/h264.c b/libavcodec/h264.c
> index 5440d7b..8226d74 100644
> --- a/libavcodec/h264.c
> +++ b/libavcodec/h264.c
> @@ -2841,8 +2841,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
>
>          if (num_ref_idx_active_override_flag) {
>              h->ref_count[0] = get_ue_golomb(&s->gb) + 1;
> -            if (h->slice_type_nos == AV_PICTURE_TYPE_B)
> +            if (h->ref_count[0] < 1)
> +                return AVERROR_INVALIDDATA;
> +            if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
>                  h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
> +                if (h->ref_count[1] < 1)
> +                    return AVERROR_INVALIDDATA;
> +            }
>          }
>
>          if (h->slice_type_nos == AV_PICTURE_TYPE_B)
>

This patch does not apply cleanly to 0.8. Do you consider this patch
important and are willing to help with adapting it?

-- 
regards,
    Reinhard


More information about the libav-stable mailing list