1. ffmpeg
  2. Commit bfd7238adbec83981ddd259e26e9e8f90d78f472
Browse code

h264: fix the check for invalid SPS:num_ref_frames.

This patch set the limit to 16.

For information, thoses previous commits:
41f7e2d11d2dca23842ee89d530ca9fa15cec9d8
5cbb0e70a0a2ee99eb3cb09e837b9a1f7355b9bc
assumed it was either 30 or 32.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcf881a6858760ecbd9ff4352a38813dc4232dd6)

Laurent Aimar authored on 2011/10/02 23:06:38
Showing 1 changed files
libavcodec/h264_ps.c
History View file @ bfd7238
... ... 
@@ -365,7 +365,7 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){
365 365 
     }
366 366
367 367 
     sps->ref_frame_count= get_ue_golomb_31(&s->gb);
368 
-    if(sps->ref_frame_count > MAX_PICTURE_COUNT-2 || sps->ref_frame_count >= 32U){
368 
+    if(sps->ref_frame_count > MAX_PICTURE_COUNT-2 || sps->ref_frame_count > 16U){
369 369 
         av_log(h->s.avctx, AV_LOG_ERROR, "too many reference frames\n");
370 370 
         goto fail;
371 371 
     }