From d63476347a486ae87ef5b1279fd813529a58849c Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sun, 12 Jan 2014 01:14:12 +0100 Subject: [PATCH] hevc: Bound check slice_qp The T-REC-H.265-2013044 page 79 states they have to be into the range [-s->sps->qp_bd_offset, 51]. Fixes: asan_stack-oob_eae8e3_9522_WP_MAIN10_B_Toshiba_3.bit Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit aead772b5814142b0e530804486ff7970ecd9eef) Signed-off-by: Michael Niedermayer --- libavcodec/hevc.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c index e6fd5cfbb0..befe2dec16 100644 --- a/libavcodec/hevc.c +++ b/libavcodec/hevc.c @@ -630,7 +630,17 @@ static int hls_slice_header(HEVCContext *s) } // Inferred parameters - sh->slice_qp = 26 + s->pps->pic_init_qp_minus26 + sh->slice_qp_delta; + sh->slice_qp = 26U + s->pps->pic_init_qp_minus26 + sh->slice_qp_delta; + if (sh->slice_qp > 51 || + sh->slice_qp < -s->sps->qp_bd_offset) { + av_log(s->avctx, AV_LOG_ERROR, + "The slice_qp %d is outside the valid range " + "[%d, 51].\n", + sh->slice_qp, + -s->sps->qp_bd_offset); + return AVERROR_INVALIDDATA; + } + sh->slice_ctb_addr_rs = sh->slice_segment_addr; s->HEVClc->first_qp_group = !s->sh.dependent_slice_segment_flag;