[vlc-commits] packetizer: h264: check num_slice_group range

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  1 15:31:34 2017 +0100| [e41d4ee7f475a8efba34ff810b119e5aff55a31b] | committer: Francois Cartegnie

packetizer: h264: check num_slice_group range

(cherry picked from commit f0eb9b6be694fbca9968ce279756f69a1499850b)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=e41d4ee7f475a8efba34ff810b119e5aff55a31b
---

 modules/packetizer/h264_nal.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/packetizer/h264_nal.c b/modules/packetizer/h264_nal.c
index 22fb99caf0..0e829c37d4 100644
--- a/modules/packetizer/h264_nal.c
+++ b/modules/packetizer/h264_nal.c
@@ -550,6 +550,8 @@ static bool h264_parse_picture_parameter_set_rbsp( bs_t *p_bs,
     p_pps->i_pic_order_present_flag = bs_read( p_bs, 1 );
 
     unsigned num_slice_groups = bs_read_ue( p_bs ) + 1;
+    if( num_slice_groups > 8 ) /* never has value > 7. Annex A, G & J */
+        return false;
     if( num_slice_groups > 1 )
     {
         unsigned slice_group_map_type = bs_read_ue( p_bs );