Commit bffe61d5 authored by Francois Cartegnie's avatar Francois Cartegnie

fix overflowing shifts (cid #1346922, cid #1253066)

parent e7f095c2
...@@ -234,7 +234,7 @@ static inline uint32_t bs_read_ue( bs_t * bs ) ...@@ -234,7 +234,7 @@ static inline uint32_t bs_read_ue( bs_t * bs )
{ {
int32_t i = 0; int32_t i = 0;
while( bs_read1( bs ) == 0 && bs->p < bs->p_end && i < 32 ) while( bs_read1( bs ) == 0 && bs->p < bs->p_end && i < 31 )
i++; i++;
return (1 << i) - 1 + bs_read( bs, i ); return (1 << i) - 1 + bs_read( bs, i );
......
...@@ -1003,7 +1003,7 @@ static bool hevc_get_picture_CtbsYsize( const hevc_sequence_parameter_set_t *p_s ...@@ -1003,7 +1003,7 @@ static bool hevc_get_picture_CtbsYsize( const hevc_sequence_parameter_set_t *p_s
{ {
const unsigned int MinCbLog2SizeY = p_sps->log2_min_luma_coding_block_size_minus3 + 3; const unsigned int MinCbLog2SizeY = p_sps->log2_min_luma_coding_block_size_minus3 + 3;
const unsigned int CtbLog2SizeY = MinCbLog2SizeY + p_sps->log2_diff_max_min_luma_coding_block_size; const unsigned int CtbLog2SizeY = MinCbLog2SizeY + p_sps->log2_diff_max_min_luma_coding_block_size;
if( CtbLog2SizeY > 32 ) if( CtbLog2SizeY > 31 )
return false; return false;
const unsigned int CtbSizeY = 1 << CtbLog2SizeY; const unsigned int CtbSizeY = 1 << CtbLog2SizeY;
*p_w = (p_sps->pic_width_in_luma_samples - 1) / CtbSizeY + 1; *p_w = (p_sps->pic_width_in_luma_samples - 1) / CtbSizeY + 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment