diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-17 00:24:20 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-17 01:29:34 +0100 |
| commit | 91253839e14cce9793ee93f184cef609ca8195d5 (patch) | |
| tree | e4a70f23413a0328de68779863cabe8bbf6f55bb | |
| parent | c919e1ca2ecfc47d796382973ba0e48b8f6f92a2 (diff) | |
avcodec/h264: more completely check the loop filter parameters
Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index cf4aa44315..a47919acb1 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -4014,8 +4014,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0) if (h->deblocking_filter) { h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1; h->slice_beta_offset += get_se_golomb(&h->gb) << 1; - if (h->slice_alpha_c0_offset > 104U || - h->slice_beta_offset > 104U) { + if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 || + h->slice_beta_offset < 52 - 12 || h->slice_beta_offset > 52 + 12) { av_log(h->avctx, AV_LOG_ERROR, "deblocking filter parameters %d %d out of range\n", h->slice_alpha_c0_offset, h->slice_beta_offset); |