summaryrefslogtreecommitdiff
path: root/libavcodec/hevc_ps.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-01-10 21:32:04 +0100
committerLuca Barbato <lu_zero@gentoo.org>2014-01-21 11:57:36 +0100
commita7a07cc98ac548297b5b0628cb81280e11952e3f (patch)
treec99d3b2aab02060a942ccb2f12fcff8116864e2e /libavcodec/hevc_ps.c
parentdd2d0039b6405dc724e4fef0d5b8f49530eea3aa (diff)
downloadffmpeg-a7a07cc98ac548297b5b0628cb81280e11952e3f.tar.gz
hevc: check that VPS referenced from SPS exists
This matches how its done for SPS/PPS. Fixes null pointer dereference. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec/hevc_ps.c')
-rw-r--r--libavcodec/hevc_ps.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 372ce2896b..1ce8d2ebcb 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -633,6 +633,13 @@ int ff_hevc_decode_nal_sps(HEVCContext *s)
goto err;
}
+ if (!s->vps_list[sps->vps_id]) {
+ av_log(s->avctx, AV_LOG_ERROR, "VPS %d does not exist\n",
+ sps->vps_id);
+ ret = AVERROR_INVALIDDATA;
+ goto err;
+ }
+
sps->max_sub_layers = get_bits(gb, 3) + 1;
if (sps->max_sub_layers > MAX_SUB_LAYERS) {
av_log(s->avctx, AV_LOG_ERROR, "sps_max_sub_layers out of range: %d\n",