From 91253839e14cce9793ee93f184cef609ca8195d5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 17 Feb 2014 00:24:20 +0100 Subject: avcodec/h264: more completely check the loop filter parameters Fixes out of array read Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index cf4aa44315..a47919acb1 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -4014,8 +4014,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0) if (h->deblocking_filter) { h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1; h->slice_beta_offset += get_se_golomb(&h->gb) << 1; - if (h->slice_alpha_c0_offset > 104U || - h->slice_beta_offset > 104U) { + if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 || + h->slice_beta_offset < 52 - 12 || h->slice_beta_offset > 52 + 12) { av_log(h->avctx, AV_LOG_ERROR, "deblocking filter parameters %d %d out of range\n", h->slice_alpha_c0_offset, h->slice_beta_offset); -- cgit v1.2.3