Merge commit '2d2a92f72199823a92e4e226c32e42a27ec801c0'

[ffmpeg] / libavcodec / hevc_sei.c

diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c
index ecccc692bdf7357731356fb28769df4aa3d98dfd..1770eb52c45afe3e85492de213f416baa85bb371 100644 (file)
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -78,10 +78,11 @@ static void decode_nal_sei_frame_packing_arrangement(HEVCContext *s)
 static int decode_pic_timing(HEVCContext *s)
 {
     GetBitContext *gb = &s->HEVClc->gb;
-    HEVCSPS *sps = (HEVCSPS*)s->sps_list[s->active_seq_parameter_set_id]->data;
+    HEVCSPS *sps;
 
-    if (!sps)
+    if (!s->sps_list[s->active_seq_parameter_set_id])
         return(AVERROR(ENOMEM));
+    sps = (HEVCSPS*)s->sps_list[s->active_seq_parameter_set_id]->data;
 
     if (sps->vui.frame_field_info_present_flag) {
         int pic_struct = get_bits(gb, 4);
@@ -99,21 +100,29 @@ static int decode_pic_timing(HEVCContext *s)
     return 1;
 }
 
-static void active_parameter_sets(HEVCContext *s)
+static int active_parameter_sets(HEVCContext *s)
 {
     GetBitContext *gb = &s->HEVClc->gb;
     int num_sps_ids_minus1;
     int i;
+    unsigned active_seq_parameter_set_id;
 
     get_bits(gb, 4); // active_video_parameter_set_id
     get_bits(gb, 1); // self_contained_cvs_flag
     get_bits(gb, 1); // num_sps_ids_minus1
     num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1
 
-    s->active_seq_parameter_set_id = get_ue_golomb_long(gb);
+    active_seq_parameter_set_id = get_ue_golomb_long(gb);
+    if (active_seq_parameter_set_id >= MAX_SPS_COUNT) {
+        av_log(s->avctx, AV_LOG_ERROR, "active_parameter_set_id %d invalid\n", active_seq_parameter_set_id);
+        return AVERROR_INVALIDDATA;
+    }
+    s->active_seq_parameter_set_id = active_seq_parameter_set_id;
 
     for (i = 1; i <= num_sps_ids_minus1; i++)
         get_ue_golomb_long(gb); // active_seq_parameter_set_id[i]
+
+    return 0;
 }
 
 static int decode_nal_sei_message(HEVCContext *s)