[vlc-commits] packetizer: h264: check num_slice_group range

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  1 15:31:34 2017 +0100| [f65cbd41e9ee8e80f15dd5314885c039356c3339] | committer: Francois Cartegnie

packetizer: h264: check num_slice_group range

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=f65cbd41e9ee8e80f15dd5314885c039356c3339
---

 modules/packetizer/h264_nal.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/packetizer/h264_nal.c b/modules/packetizer/h264_nal.c
index 22fb99caf0..0e829c37d4 100644
--- a/modules/packetizer/h264_nal.c
+++ b/modules/packetizer/h264_nal.c
@@ -550,6 +550,8 @@ static bool h264_parse_picture_parameter_set_rbsp( bs_t *p_bs,
     p_pps->i_pic_order_present_flag = bs_read( p_bs, 1 );
 
     unsigned num_slice_groups = bs_read_ue( p_bs ) + 1;
+    if( num_slice_groups > 8 ) /* never has value > 7. Annex A, G & J */
+        return false;
     if( num_slice_groups > 1 )
     {
         unsigned slice_group_map_type = bs_read_ue( p_bs );