| Index: libavcodec/h264.c
|
| diff --git a/libavcodec/h264.c b/libavcodec/h264.c
|
| index 7a16bdaedc3039b5441bf86fc3d671e25ad5965a..2fea444e94e5cb70b6b4fe92d103f9adf1a85317 100644
|
| --- a/libavcodec/h264.c
|
| +++ b/libavcodec/h264.c
|
| @@ -25,8 +25,6 @@
|
| * @author Michael Niedermayer <michaelni@gmx.at>
|
| */
|
|
|
| -#define UNCHECKED_BITSTREAM_READER 1
|
| -
|
| #include "libavutil/imgutils.h"
|
| #include "libavutil/opt.h"
|
| #include "internal.h"
|
| @@ -1097,6 +1095,8 @@ int ff_h264_decode_extradata(H264Context *h, const uint8_t *buf, int size)
|
| cnt = *(p+5) & 0x1f; // Number of sps
|
| p += 6;
|
| for (i = 0; i < cnt; i++) {
|
| + if(size - (p-buf) < 2)
|
| + return -1;
|
| nalsize = AV_RB16(p) + 2;
|
| if(nalsize > size - (p-buf))
|
| return -1;
|
| @@ -1106,9 +1106,13 @@ int ff_h264_decode_extradata(H264Context *h, const uint8_t *buf, int size)
|
| }
|
| p += nalsize;
|
| }
|
| + if(size - (p-buf) <= 0)
|
| + return -1;
|
| // Decode pps from avcC
|
| cnt = *(p++); // Number of pps
|
| for (i = 0; i < cnt; i++) {
|
| + if(size - (p-buf) < 2)
|
| + return -1;
|
| nalsize = AV_RB16(p) + 2;
|
| if(nalsize > size - (p-buf))
|
| return -1;
|
|
|