[vlc-commits] packetizer: hevc: check short term ref pics loop

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Nov  2 15:50:18 2016 +0100| [3ed5854521eef9747be855f95c3d0aec41343b1c] | committer: Francois Cartegnie

packetizer: hevc: check short term ref pics loop

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=3ed5854521eef9747be855f95c3d0aec41343b1c
---

 modules/packetizer/hevc_nal.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/packetizer/hevc_nal.c b/modules/packetizer/hevc_nal.c
index 9eb7e5e..f5fd24e 100644
--- a/modules/packetizer/hevc_nal.c
+++ b/modules/packetizer/hevc_nal.c
@@ -741,6 +741,8 @@ static bool hevc_parse_st_ref_pic_set( bs_t *p_bs, unsigned stRpsIdx,
     {
         nal_ue_t num_negative_pics = bs_read_ue( p_bs );
         nal_ue_t num_positive_pics = bs_read_ue( p_bs );
+        if( bs_remain( p_bs ) < ((uint64_t)num_negative_pics + num_positive_pics) * 2 )
+            return false;
         for(unsigned int i=0; i<num_negative_pics; i++)
         {
             (void) bs_read_ue( p_bs ); /* delta_poc_s0_minus1 */