From 1ad3e05f1388cd9556a34ee876b03ef027e95bc3 Mon Sep 17 00:00:00 2001 From: Grey Li Date: Wed, 18 May 2022 19:58:28 +0800 Subject: [PATCH] [h264d]: fix sps id overflow Signed-off-by: Grey Li Change-Id: I3aec751595f4441dac8e9d47065eaf52d40ded5b --- mpp/codec/dec/h264/h264d_sei.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mpp/codec/dec/h264/h264d_sei.c b/mpp/codec/dec/h264/h264d_sei.c index efdf9575..4f0511b0 100755 --- a/mpp/codec/dec/h264/h264d_sei.c +++ b/mpp/codec/dec/h264/h264d_sei.c @@ -37,9 +37,10 @@ static MPP_RET interpret_picture_timing_info( H264_SEI_PIC_TIMING_t *pic_timing = NULL; RK_U32 num_clock_ts[9] = {1, 1, 1, 2, 2, 3, 3, 2, 3}; struct h264_vui_t *vui_seq_parameters = NULL; + RK_S32 seq_parameter_set_id = sei_msg->seq_parameter_set_id; - if (!p_videoctx->spsSet[sei_msg->seq_parameter_set_id]) { - H264D_ERR("seq_parameter_set_id %d may be invalid\n", sei_msg->seq_parameter_set_id); + if (seq_parameter_set_id >= MAXSPS || !p_videoctx->spsSet[seq_parameter_set_id]) { + H264D_ERR("seq_parameter_set_id %d may be invalid\n", seq_parameter_set_id); goto __BITREAD_ERR; } vui_seq_parameters = &(p_videoctx->spsSet[sei_msg->seq_parameter_set_id]->vui_seq_parameters);