[FFmpeg-cvslog] Merge commit '1329c08ad6d2ddb304858f2972c67b508e8b0f0e'

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Sat Nov 11 00:36:22 2017 -0300| [36e0093dd91fa75ded475f2430852a6b0e86b59a] | committer: James Almer

Merge commit '1329c08ad6d2ddb304858f2972c67b508e8b0f0e'

* commit '1329c08ad6d2ddb304858f2972c67b508e8b0f0e':
  hevc: Validate the number of long term reference pictures

See ea38e5a6b75706477898eb1e6582d667dbb9946c

Merged-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=36e0093dd91fa75ded475f2430852a6b0e86b59a
---

 libavcodec/hevc_ps.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index 72d02c8372..a4f7ed60f7 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -1075,8 +1075,8 @@ int ff_hevc_parse_sps(HEVCSPS *sps, GetBitContext *gb, unsigned int *sps_id,
     sps->long_term_ref_pics_present_flag = get_bits1(gb);
     if (sps->long_term_ref_pics_present_flag) {
         sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
-        if (sps->num_long_term_ref_pics_sps > 31U) {
-            av_log(avctx, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
+        if (sps->num_long_term_ref_pics_sps > HEVC_MAX_LONG_TERM_REF_PICS) {
+            av_log(avctx, AV_LOG_ERROR, "Too many long term ref pics: %d.\n",
                    sps->num_long_term_ref_pics_sps);
             return AVERROR_INVALIDDATA;
         }


======================================================================

diff --cc libavcodec/hevc_ps.c
index 72d02c8372,2603e6d99f..a4f7ed60f7
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@@ -1075,10 -883,11 +1075,10 @@@ int ff_hevc_parse_sps(HEVCSPS *sps, Get
      sps->long_term_ref_pics_present_flag = get_bits1(gb);
      if (sps->long_term_ref_pics_present_flag) {
          sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb);
-         if (sps->num_long_term_ref_pics_sps > 31U) {
-             av_log(avctx, AV_LOG_ERROR, "num_long_term_ref_pics_sps %d is out of range.\n",
+         if (sps->num_long_term_ref_pics_sps > HEVC_MAX_LONG_TERM_REF_PICS) {
+             av_log(avctx, AV_LOG_ERROR, "Too many long term ref pics: %d.\n",
                     sps->num_long_term_ref_pics_sps);
 -            ret = AVERROR_INVALIDDATA;
 -            goto err;
 +            return AVERROR_INVALIDDATA;
          }
          for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) {
              sps->lt_ref_pic_poc_lsb_sps[i]       = get_bits(gb, sps->log2_max_poc_lsb);