From: Michael Niedermayer <michaelni@gmx.at>
Date: Sun, 16 Feb 2014 23:24:20 +0000 (+0100)
Subject: avcodec/h264: more completely check the loop filter parameters
X-Git-Tag: n2.2-rc1~214
X-Git-Url: http://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/91253839e14cce9793ee93f184cef609ca8195d5

avcodec/h264: more completely check the loop filter parameters

Fixes out of array read
Fixes: caa65cc01655505705129b677189f036-signal_sigsegv_fdcc43_2681_cov_3043376737_PPH422I5_Panasonic_A.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index cf4aa44315..a47919acb1 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -4014,8 +4014,8 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
         if (h->deblocking_filter) {
             h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1;
             h->slice_beta_offset     += get_se_golomb(&h->gb) << 1;
-            if (h->slice_alpha_c0_offset > 104U ||
-                h->slice_beta_offset     > 104U) {
+            if (h->slice_alpha_c0_offset < 52 - 12 || h->slice_alpha_c0_offset > 52 + 12 ||
+                h->slice_beta_offset     < 52 - 12 || h->slice_beta_offset     > 52 + 12) {
                 av_log(h->avctx, AV_LOG_ERROR,
                        "deblocking filter parameters %d %d out of range\n",
                        h->slice_alpha_c0_offset, h->slice_beta_offset);