diff options
Diffstat (limited to 'chromium/media/gpu/h264_decoder.cc')
| -rw-r--r-- | chromium/media/gpu/h264_decoder.cc | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/chromium/media/gpu/h264_decoder.cc b/chromium/media/gpu/h264_decoder.cc index 59ab81d16ba..93abea8c715 100644 --- a/chromium/media/gpu/h264_decoder.cc +++ b/chromium/media/gpu/h264_decoder.cc @@ -8,6 +8,7 @@ #include "base/bind.h" #include "base/bind_helpers.h" #include "base/callback_helpers.h" +#include "base/logging.h" #include "base/numerics/safe_conversions.h" #include "base/optional.h" #include "base/stl_util.h" @@ -567,6 +568,13 @@ bool H264Decoder::ModifyReferencePicList(const H264SliceHeader* slice_hdr, DVLOG(1) << "Malformed stream, no pic num " << pic_num_lx; return false; } + + if (ref_idx_lx > num_ref_idx_lX_active_minus1) { + DVLOG(1) << "Bounds mismatch: expected " << ref_idx_lx + << " <= " << num_ref_idx_lX_active_minus1; + return false; + } + ShiftRightAndInsert(ref_pic_listx, ref_idx_lx, num_ref_idx_lX_active_minus1, pic); ref_idx_lx++; |