[FFmpeg-cvslog] hevc: Bound check slice_qp

[Luca Barbato]

ffmpeg | branch: release/2.1 | Luca Barbato <lu_zero at gentoo.org> | Sun Jan 12 01:14:12 2014 +0100| [d63476347a486ae87ef5b1279fd813529a58849c] | committer: Michael Niedermayer

hevc: Bound check slice_qp

The T-REC-H.265-2013044 page 79 states they have to be into the range
[-s->sps->qp_bd_offset, 51].

Fixes: asan_stack-oob_eae8e3_9522_WP_MAIN10_B_Toshiba_3.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit aead772b5814142b0e530804486ff7970ecd9eef)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d63476347a486ae87ef5b1279fd813529a58849c
---

 libavcodec/hevc.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index e6fd5cf..befe2de 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -630,7 +630,17 @@ static int hls_slice_header(HEVCContext *s)
     }
 
     // Inferred parameters
-    sh->slice_qp          = 26 + s->pps->pic_init_qp_minus26 + sh->slice_qp_delta;
+    sh->slice_qp = 26U + s->pps->pic_init_qp_minus26 + sh->slice_qp_delta;
+    if (sh->slice_qp > 51 ||
+        sh->slice_qp < -s->sps->qp_bd_offset) {
+        av_log(s->avctx, AV_LOG_ERROR,
+               "The slice_qp %d is outside the valid range "
+               "[%d, 51].\n",
+               sh->slice_qp,
+               -s->sps->qp_bd_offset);
+        return AVERROR_INVALIDDATA;
+    }
+
     sh->slice_ctb_addr_rs = sh->slice_segment_addr;
 
     s->HEVClc->first_qp_group = !s->sh.dependent_slice_segment_flag;