Commit Graph

1 Commits

Author SHA1 Message Date
Moritz Bunkus
814b6a000d HEVC parser: fix invalid memory access beyond the end of allocated space part 2
This is the same issue that 8a3c7197a2 was
trying to address, albeit incompletely.

The sps_t structure contains an array of 64 short_term_ref_pic_sets_t
elements. Therefore at most 63 may be added to the base pointer
short_term_ref_pic_sets for accessing one of those elements.

Fixes the following test cases of #1780:

explorer🆔000355,sig:11,src:000738,op:havoc,rep:4
explorer🆔000497,sig:11,src:001249,op:flip1,pos:101
2016-09-07 20:49:09 +02:00