diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index 03bf068ce2..f673b08c15 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -138,7 +138,7 @@ fail: return AVERROR(ENOMEM); } -static void pred_weight_table(HEVCContext *s, GetBitContext *gb) +static int pred_weight_table(HEVCContext *s, GetBitContext *gb) { int i = 0; int j = 0; @@ -181,6 +181,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) for (j = 0; j < 2; j++) { int delta_chroma_weight_l0 = get_se_golomb(gb); int delta_chroma_offset_l0 = get_se_golomb(gb); + + if ( (int8_t)delta_chroma_weight_l0 != delta_chroma_weight_l0 + || delta_chroma_offset_l0 < -(1<<17) || delta_chroma_offset_l0 > (1<<17)) { + return AVERROR_INVALIDDATA; + } + s->sh.chroma_weight_l0[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l0; s->sh.chroma_offset_l0[i][j] = av_clip((delta_chroma_offset_l0 - ((128 * s->sh.chroma_weight_l0[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); @@ -217,6 +223,12 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) for (j = 0; j < 2; j++) { int delta_chroma_weight_l1 = get_se_golomb(gb); int delta_chroma_offset_l1 = get_se_golomb(gb); + + if ( (int8_t)delta_chroma_weight_l1 != delta_chroma_weight_l1 + || delta_chroma_offset_l1 < -(1<<17) || delta_chroma_offset_l1 > (1<<17)) { + return AVERROR_INVALIDDATA; + } + s->sh.chroma_weight_l1[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l1; s->sh.chroma_offset_l1[i][j] = av_clip((delta_chroma_offset_l1 - ((128 * s->sh.chroma_weight_l1[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); @@ -229,6 +241,7 @@ static void pred_weight_table(HEVCContext *s, GetBitContext *gb) } } } + return 0; } static int decode_lt_rps(HEVCContext *s, LongTermRPS *rps, GetBitContext *gb) @@ -682,7 +695,9 @@ static int hls_slice_header(HEVCContext *s) if ((s->ps.pps->weighted_pred_flag && sh->slice_type == HEVC_SLICE_P) || (s->ps.pps->weighted_bipred_flag && sh->slice_type == HEVC_SLICE_B)) { - pred_weight_table(s, gb); + int ret = pred_weight_table(s, gb); + if (ret < 0) + return ret; } sh->max_num_merge_cand = 5 - get_ue_golomb_long(gb);