[vlc-commits] packetizer: h264: check num_slice_group range

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  1 15:31:34 2017 +0100| [3bbd21e0da7304b64db3b5e408da58dc7e054509] | committer: Francois Cartegnie

packetizer: h264: check num_slice_group range

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=3bbd21e0da7304b64db3b5e408da58dc7e054509
---

 modules/packetizer/h264_nal.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/packetizer/h264_nal.c b/modules/packetizer/h264_nal.c
index 22fb99caf0..0e829c37d4 100644
--- a/modules/packetizer/h264_nal.c
+++ b/modules/packetizer/h264_nal.c
@@ -550,6 +550,8 @@ static bool h264_parse_picture_parameter_set_rbsp( bs_t *p_bs,
     p_pps->i_pic_order_present_flag = bs_read( p_bs, 1 );
 
     unsigned num_slice_groups = bs_read_ue( p_bs ) + 1;
+    if( num_slice_groups > 8 ) /* never has value > 7. Annex A, G & J */
+        return false;
     if( num_slice_groups > 1 )
     {
         unsigned slice_group_map_type = bs_read_ue( p_bs );