Commit 91253839 authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/h264: more completely check the loop filter parameters

Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent c919e1ca
...@@ -4014,8 +4014,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0) ...@@ -4014,8 +4014,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
if (h->deblocking_filter) { if (h->deblocking_filter) {
h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1; h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1;
h->slice_beta_offset += get_se_golomb(&h->gb) << 1; h->slice_beta_offset += get_se_golomb(&h->gb) << 1;
if (h->slice_alpha_c0_offset > 104U || if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 ||
h->slice_beta_offset > 104U) { h->slice_beta_offset < 52 - 12 || h->slice_beta_offset > 52 + 12) {
av_log(h->avctx, AV_LOG_ERROR, av_log(h->avctx, AV_LOG_ERROR,
"deblocking filter parameters %d %d out of range\n", "deblocking filter parameters %d %d out of range\n",
h->slice_alpha_c0_offset, h->slice_beta_offset); h->slice_alpha_c0_offset, h->slice_beta_offset);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment