X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fhevc_sei.c;h=13ebcd3ede7e3b925ed5487a8d723da0c5e71a2d;hb=d3dcd2881247a5249d555f25f3f163a441c46237;hp=5bb5c9010a73ccaf77d6bded964087538f32ba3f;hpb=037c9c25e6213852e33de5b6e00bbf9d26195938;p=ffmpeg

diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c
index 5bb5c9010a7..13ebcd3ede7 100644
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -126,6 +126,11 @@ static int active_parameter_sets(HEVCContext *s)
     get_bits(gb, 1); // num_sps_ids_minus1
     num_sps_ids_minus1 = get_ue_golomb_long(gb); // num_sps_ids_minus1
 
+    if (num_sps_ids_minus1 < 0 || num_sps_ids_minus1 > 15) {
+        av_log(s->avctx, AV_LOG_ERROR, "num_sps_ids_minus1 %d invalid\n", num_sps_ids_minus1);
+        return AVERROR_INVALIDDATA;
+    }
+
     active_seq_parameter_set_id = get_ue_golomb_long(gb);
     if (active_seq_parameter_set_id >= MAX_SPS_COUNT) {
         av_log(s->avctx, AV_LOG_ERROR, "active_parameter_set_id %d invalid\n", active_seq_parameter_set_id);