[FFmpeg-cvslog] avcodec/hevc: check slice_header_extension data length

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Jul 12 05:07:16 2014 +0200| [5d88e40093ffc9ed3d643516b4502edfe12d7756] | committer: Michael Niedermayer

avcodec/hevc: check slice_header_extension data length

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5d88e40093ffc9ed3d643516b4502edfe12d7756
---

 libavcodec/hevc.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index 8ae8fc7..a64c627 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -708,6 +708,10 @@ static int hls_slice_header(HEVCContext *s)
 
     if (s->pps->slice_header_extension_present_flag) {
         unsigned int length = get_ue_golomb_long(gb);
+        if (length*8LL > get_bits_left(gb)) {
+            av_log(s->avctx, AV_LOG_ERROR, "too many slice_header_extension_data_bytes\n");
+            return AVERROR_INVALIDDATA;
+        }
         for (i = 0; i < length; i++)
             skip_bits(gb, 8);  // slice_header_extension_data_byte
     }