Commit 29a09eae authored by Jeff Downs's avatar Jeff Downs Committed by Diego Biurrun

h264: correct the check for invalid long term frame index in MMCO decode

The current check on MMCO parameters prohibits a "max long term frame index
plus 1" of 16 (frame idx of 15) for the "set max long term frame index" MMCO.
Fix this off-by-one error to allow the full range of legal values.
Signed-off-by: 's avatarDiego Biurrun <diego@biurrun.de>
parent bb337b4f
...@@ -685,7 +685,7 @@ int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){ ...@@ -685,7 +685,7 @@ int ff_h264_decode_ref_pic_marking(H264Context *h, GetBitContext *gb){
} }
if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){ if(opcode==MMCO_SHORT2LONG || opcode==MMCO_LONG2UNUSED || opcode==MMCO_LONG || opcode==MMCO_SET_MAX_LONG){
unsigned int long_arg= get_ue_golomb_31(gb); unsigned int long_arg= get_ue_golomb_31(gb);
if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){ if(long_arg >= 32 || (long_arg >= 16 && !(opcode == MMCO_SET_MAX_LONG && long_arg == 16) && !(opcode == MMCO_LONG2UNUSED && FIELD_PICTURE))){
av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode); av_log(h->s.avctx, AV_LOG_ERROR, "illegal long ref in memory management control operation %d\n", opcode);
return -1; return -1;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment