[FFmpeg-cvslog] h264: check ref_count validity for num_ref_idx_active_override_flag

[Janne Grunau]

ffmpeg | branch: release/0.8 | Janne Grunau <janne-libav at jannau.net> | Sat Jan 12 17:22:50 2013 +0100| [dd0c5e0fa909bac905ea8baa49b704892792a1c9] | committer: Reinhard Tartler

h264: check ref_count validity for num_ref_idx_active_override_flag

Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
CC: libav-stable at libav.org
(cherry-picked from commit 6e5cdf26281945ddea3aaf5eca4d127791f23ca8)
Signed-off-by: Janne Grunau <janne-libav at jannau.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dd0c5e0fa909bac905ea8baa49b704892792a1c9
---

 libavcodec/h264.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index 1f85eea..739b9d2 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -2890,8 +2890,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
 
         if(num_ref_idx_active_override_flag){
             h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
-            if(h->slice_type_nos==AV_PICTURE_TYPE_B)
+            if (h->ref_count[0] < 1)
+                return AVERROR_INVALIDDATA;
+            if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
                 h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
+                if (h->ref_count[1] < 1)
+                    return AVERROR_INVALIDDATA;
+            }
         }
 
         if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) {