[vlc-commits] packetizer: hevc: check pps heterogenous tiling sizes loop (fix #17591)

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Nov  2 15:39:45 2016 +0100| [68dc8e754ad7b805f5ce29da0e95511afb6660c5] | committer: Francois Cartegnie

packetizer: hevc: check pps heterogenous tiling sizes loop (fix #17591)

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=68dc8e754ad7b805f5ce29da0e95511afb6660c5
---

 modules/packetizer/hevc_nal.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/modules/packetizer/hevc_nal.c b/modules/packetizer/hevc_nal.c
index 3e4e7d9..9eb7e5e 100644
--- a/modules/packetizer/hevc_nal.c
+++ b/modules/packetizer/hevc_nal.c
@@ -939,6 +939,9 @@ static bool hevc_parse_pic_parameter_set_rbsp( bs_t *p_bs,
         p_pps->uniform_spacing_flag = bs_read1( p_bs );
         if( !p_pps->uniform_spacing_flag )
         {
+            if( bs_remain( p_bs ) < (uint64_t) p_pps->num_tile_columns_minus1 +
+                                               p_pps->num_tile_rows_minus1 + 1 )
+                return false;
             for( unsigned i=0; i< p_pps->num_tile_columns_minus1; i++ )
                 (void) bs_read_ue( p_bs );
             for( unsigned i=0; i< p_pps->num_tile_rows_minus1; i++ )