commit ddbbe500b04a6c2a6551461843e6c94e5576fcbf
author Laurent Aimar <fenrir@videolan.org> Sun Oct 02 16:06:38 2011 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sun Nov 06 19:49:12 2011 +0100
tree df0ec00c69b01960461aea625076b66f02578fc5
parent d1a5b53ededd091484949a33c6e9f97d4612602d

h264: fix the check for invalid SPS:num_ref_frames.

This patch set the limit to 16.

For information, thoses previous commits:
41f7e2d11d2dca23842ee89d530ca9fa15cec9d8
5cbb0e70a0a2ee99eb3cb09e837b9a1f7355b9bc
assumed it was either 30 or 32.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit bcf881a6858760ecbd9ff4352a38813dc4232dd6)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/h264.c

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index c3771f2..205f801 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -7167,7 +7167,7 @@
     }
 
     sps->ref_frame_count= get_ue_golomb_31(&s->gb);
-    if(sps->ref_frame_count > MAX_PICTURE_COUNT-2 || sps->ref_frame_count >= 32U){
+    if(sps->ref_frame_count > MAX_PICTURE_COUNT-2 || sps->ref_frame_count > 16U){
         av_log(h->s.avctx, AV_LOG_ERROR, "too many reference frames\n");
         goto fail;
     }