[FFmpeg-devel] [PATCH] avcodec/h264dec: fix possible out-of-bounds array access

[Niklas Haas]

From: Niklas Haas <git at haasn.dev>

If slice_type is > 9, the access to ff_h264_golomb_to_pict_type is
out-of-bounds. Fix this by simply setting the slice_type to 0 in this
case.

This is completely inconsequential because the value is only being used
to being used as an offset in the calculation of the film grain seed
value, a corruption of which is practically invisible.

Fixes coverity ticket #1490802
---
 libavcodec/h264dec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavcodec/h264dec.c b/libavcodec/h264dec.c
index 5e5b1c1d69..595b6c81fb 100644
--- a/libavcodec/h264dec.c
+++ b/libavcodec/h264dec.c
@@ -536,6 +536,7 @@ static int get_last_needed_nal(H264Context *h)
             if (slice_type > 9) {
                 if (h->avctx->err_recognition & AV_EF_EXPLODE)
                     return AVERROR_INVALIDDATA;
+                slice_type = 0;
             }
             if (slice_type > 4)
                 slice_type -= 5;
-- 
2.32.0