h264parser: fix MAX_SPS/PPS boundary checks

diff --git a/gst-libs/gst/codecparsers/gsth264parser.c b/gst-libs/gst/codecparsers/gsth264parser.c
index b496c0f..c50c7f3 100644 (file)
--- a/gst-libs/gst/codecparsers/gsth264parser.c
+++ b/gst-libs/gst/codecparsers/gsth264parser.c
@@ -953,7 +953,7 @@ gst_h264_parser_parse_buffering_period (GstH264NalParser * nalparser,
 
   GST_DEBUG ("parsing \"Buffering period\"");
 
-  READ_UE_ALLOWED (nr, sps_id, 0, GST_H264_MAX_SPS_COUNT);
+  READ_UE_ALLOWED (nr, sps_id, 0, GST_H264_MAX_SPS_COUNT - 1);
   sps = gst_h264_parser_get_sps (nalparser, sps_id);
   if (!sps) {
     GST_WARNING ("couldn't find associated sequence parameter set with id: %d",
@@ -1372,7 +1372,7 @@ gst_h264_parse_sps (GstH264NalUnit * nalu, GstH264SPS * sps,
 
   READ_UINT8 (&nr, sps->level_idc, 8);
 
-  READ_UE_ALLOWED (&nr, sps->id, 0, GST_H264_MAX_SPS_COUNT);
+  READ_UE_ALLOWED (&nr, sps->id, 0, GST_H264_MAX_SPS_COUNT - 1);
 
   if (sps->profile_idc == 100 || sps->profile_idc == 110 ||
       sps->profile_idc == 122 || sps->profile_idc == 244 ||
@@ -1523,8 +1523,8 @@ gst_h264_parse_pps (GstH264NalParser * nalparser, GstH264NalUnit * nalu,
 
   nal_reader_init (&nr, nalu->data + nalu->offset + 1, nalu->size - 1);
 
-  READ_UE_ALLOWED (&nr, pps->id, 0, GST_H264_MAX_PPS_COUNT);
-  READ_UE_ALLOWED (&nr, sps_id, 0, GST_H264_MAX_SPS_COUNT);
+  READ_UE_ALLOWED (&nr, pps->id, 0, GST_H264_MAX_PPS_COUNT - 1);
+  READ_UE_ALLOWED (&nr, sps_id, 0, GST_H264_MAX_SPS_COUNT - 1);
 
   sps = gst_h264_parser_get_sps (nalparser, sps_id);
   if (!sps) {