[vlc-commits] packetizer: h264: fix invalid dereference (fix #17585)

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Nov 10 15:13:29 2016 +0100| [59259c8d49ea18dfc1dac546124d1e5d10da9740] | committer: Francois Cartegnie

packetizer: h264: fix invalid dereference (fix #17585)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=59259c8d49ea18dfc1dac546124d1e5d10da9740
---

 modules/packetizer/h264.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/packetizer/h264.c b/modules/packetizer/h264.c
index e671f6e..7e29b86 100644
--- a/modules/packetizer/h264.c
+++ b/modules/packetizer/h264.c
@@ -572,7 +572,7 @@ static void CreateDecodedNAL( uint8_t **pp_ret, int *pi_ret,
     *pi_ret = dst - *pp_ret;
 }
 
-static inline int bs_read_ue( bs_t *s )
+static inline uint32_t bs_read_ue( bs_t *s )
 {
     int i = 0;
 
@@ -580,7 +580,7 @@ static inline int bs_read_ue( bs_t *s )
     {
         i++;
     }
-    return( ( 1 << i) - 1 + bs_read( s, i ) );
+    return( ( 1u << i) - 1 + bs_read( s, i ) );
 }
 
 static inline int bs_read_se( bs_t *s )
@@ -794,7 +794,7 @@ static void PutSPS( decoder_t *p_dec, block_t *p_frag )
     int     i_dec = 0;
     bs_t s;
     int i_tmp;
-    int i_sps_id;
+    uint32_t i_sps_id;
 
     CreateDecodedNAL( &pb_dec, &i_dec, &p_frag->p_buffer[5],
                      p_frag->i_buffer - 5 );
@@ -807,9 +807,9 @@ static void PutSPS( decoder_t *p_dec, block_t *p_frag )
     p_dec->fmt_out.i_level = bs_read( &s, 8 );
     /* sps id */
     i_sps_id = bs_read_ue( &s );
-    if( i_sps_id >= SPS_MAX || i_sps_id < 0 )
+    if( i_sps_id >= SPS_MAX )
     {
-        msg_Warn( p_dec, "invalid SPS (sps_id=%d)", i_sps_id );
+        msg_Warn( p_dec, "invalid SPS (sps_id=%u)", i_sps_id );
         free( pb_dec );
         block_Release( p_frag );
         return;
@@ -989,8 +989,8 @@ static void PutPPS( decoder_t *p_dec, block_t *p_frag )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
     bs_t s;
-    int i_pps_id;
-    int i_sps_id;
+    uint32_t i_pps_id;
+    uint32_t i_sps_id;
 
     bs_init( &s, &p_frag->p_buffer[5], p_frag->i_buffer - 5 );
     i_pps_id = bs_read_ue( &s ); // pps id