packetizer: hevc: cap max_num_negative/positive_pics

refs #29559
7 months ago · aa0bb8e562
1 changed files with 4 additions and 1 deletions
--- a/modules/packetizer/hevc_nal.c
+++ b/modules/packetizer/hevc_nal.c
@ -733,7 +733,10 @@ static bool hevc_parse_st_ref_pic_set( bs_t *p_bs, unsigned stRpsIdx,
    {
        nal_ue_t num_negative_pics = bs_read_ue( p_bs );
        nal_ue_t num_positive_pics = bs_read_ue( p_bs );
-        if( bs_error( p_bs ) )
+        // A.4.2 total to (MaxDpbSize -1) with MaxDpbSize capped either at 16 or 7
+        if( bs_error( p_bs ) ||
+            num_negative_pics >= 16 || num_positive_pics >= 16 ||
+            num_negative_pics + num_positive_pics >= 16 )
            return false;
        for(unsigned int i=0; i<num_negative_pics; i++)
        {