diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-17 00:24:20 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-23 15:02:14 +0100 |
| commit | d0d441b35053e04bbca2149cbf08f14499a1619c (patch) | |
| tree | 69becad7bf7e75f649943ace20b09a5d597f374c | |
| parent | 6341a7006d74bf557c9ffb2a19f15e511d9b3b2b (diff) | |
| download | ffmpeg-d0d441b35053e04bbca2149cbf08f14499a1619c.tar.gz | |
avcodec/h264: more completely check the loop filter parameters
Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 91253839e14cce9793ee93f184cef609ca8195d5)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 3e209c3e9c..3b5c126079 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -3932,8 +3932,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0) if (h->deblocking_filter) { h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1; h->slice_beta_offset += get_se_golomb(&h->gb) << 1; - if (h->slice_alpha_c0_offset > 104U || - h->slice_beta_offset > 104U) { + if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 || + h->slice_beta_offset < 52 - 12 || h->slice_beta_offset > 52 + 12) { av_log(h->avctx, AV_LOG_ERROR, "deblocking filter parameters %d %d out of range\n", h->slice_alpha_c0_offset, h->slice_beta_offset); |