From fdfbcbdd148765ba0fa5093d7feb944685a3e8c2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 20 Jun 2017 14:32:50 +0200 Subject: [PATCH] avcodec/hevcdec: Check beta and tc offset in hls_slice_header() Signed-off-by: Michael Niedermayer --- libavcodec/hevcdec.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index 3dc3669d67..0c478029c9 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -726,8 +726,17 @@ static int hls_slice_header(HEVCContext *s) if (deblocking_filter_override_flag) { sh->disable_deblocking_filter_flag = get_bits1(gb); if (!sh->disable_deblocking_filter_flag) { - sh->beta_offset = get_se_golomb(gb) * 2; - sh->tc_offset = get_se_golomb(gb) * 2; + int beta_offset_div2 = get_se_golomb(gb); + int tc_offset_div2 = get_se_golomb(gb) ; + if (beta_offset_div2 < -6 || beta_offset_div2 > 6 || + tc_offset_div2 < -6 || tc_offset_div2 > 6) { + av_log(s->avctx, AV_LOG_ERROR, + "Invalid deblock filter offsets: %d, %d\n", + beta_offset_div2, tc_offset_div2); + return AVERROR_INVALIDDATA; + } + sh->beta_offset = beta_offset_div2 * 2; + sh->tc_offset = tc_offset_div2 * 2; } } else { sh->disable_deblocking_filter_flag = s->ps.pps->disable_dbf;