avfilter/vf_identity: remove unnecessary check

[ffmpeg] / libavcodec / cbs_sei_syntax_template.c

diff --git a/libavcodec/cbs_sei_syntax_template.c b/libavcodec/cbs_sei_syntax_template.c
index 5f842466636cda18b28cccfefef7135201402d38..0ef7b42ed9c1915cdd07eb12120bc7ffc256219b 100644 (file)
--- a/libavcodec/cbs_sei_syntax_template.c
+++ b/libavcodec/cbs_sei_syntax_template.c
@@ -103,17 +103,15 @@ static int FUNC(mastering_display_colour_volume)
     HEADER("Mastering Display Colour Volume");
 
     for (c = 0; c < 3; c++) {
-        us(16, display_primaries_x[c], 0, 50000, 1, c);
-        us(16, display_primaries_y[c], 0, 50000, 1, c);
+        ubs(16, display_primaries_x[c], 1, c);
+        ubs(16, display_primaries_y[c], 1, c);
     }
 
-    u(16, white_point_x, 0, 50000);
-    u(16, white_point_y, 0, 50000);
+    ub(16, white_point_x);
+    ub(16, white_point_y);
 
-    u(32, max_display_mastering_luminance,
-      1, MAX_UINT_BITS(32));
-    u(32, min_display_mastering_luminance,
-      0, current->max_display_mastering_luminance - 1);
+    ub(32, max_display_mastering_luminance);
+    ub(32, min_display_mastering_luminance);
 
     return 0;
 }
@@ -240,6 +238,7 @@ static int FUNC(message_list)(CodedBitstreamContext *ctx, RWContext *rw,
         uint32_t payload_type = 0;
         uint32_t payload_size = 0;
         uint32_t tmp;
+        GetBitContext payload_gbc;
 
         while (show_bits(rw, 8) == 0xff) {
             fixed(8, ff_byte, 0xff);
@@ -255,13 +254,27 @@ static int FUNC(message_list)(CodedBitstreamContext *ctx, RWContext *rw,
         xu(8, last_payload_size_byte, tmp, 0, 254, 0);
         payload_size += tmp;
 
+        // There must be space remaining for both the payload and
+        // the trailing bits on the SEI NAL unit.
+        if (payload_size + 1 > get_bits_left(rw) / 8) {
+            av_log(ctx->log_ctx, AV_LOG_ERROR,
+                   "Invalid SEI message: payload_size too large "
+                   "(%"PRIu32" bytes).\n", payload_size);
+            return AVERROR_INVALIDDATA;
+        }
+        CHECK(init_get_bits(&payload_gbc, rw->buffer,
+                            get_bits_count(rw) + 8 * payload_size));
+        skip_bits_long(&payload_gbc, get_bits_count(rw));
+
         CHECK(ff_cbs_sei_list_add(current));
         message = &current->messages[k];
 
         message->payload_type = payload_type;
         message->payload_size = payload_size;
 
-        CHECK(FUNC(message)(ctx, rw, message));
+        CHECK(FUNC(message)(ctx, &payload_gbc, message));
+
+        skip_bits_long(rw, 8 * payload_size);
 
         if (!cbs_h2645_read_more_rbsp_data(rw))
             break;