[libav-devel] [PATCH 4/6] hevc: Validate the SEI payload size

[Luca Barbato]

And use skip_bits_long instead of skip_bits.

CC: libav-sta...@libav.org
---
 libavcodec/hevc_sei.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/libavcodec/hevc_sei.c b/libavcodec/hevc_sei.c
index 4b62422..8727b65 100644
--- a/libavcodec/hevc_sei.c
+++ b/libavcodec/hevc_sei.c
@@ -122,8 +122,8 @@ static int decode_nal_sei_message(HEVCContext *s)
 {
     GetBitContext *gb = &s->HEVClc.gb;
 
-    int payload_type = 0;
-    int payload_size = 0;
+    unsigned int payload_type = 0;
+    unsigned int payload_size = 0;
     int byte = 0xFF;
     av_log(s->avctx, AV_LOG_DEBUG, "Decoding SEI\n");
 
@@ -135,7 +135,20 @@ static int decode_nal_sei_message(HEVCContext *s)
     while (byte == 0xFF) {
         byte          = get_bits(gb, 8);
         payload_size += byte;
+
+        if (payload_size > INT_MAX / 8) {
+            avpriv_request_sample(s->avctx, "%d bytes large SEI message",
+                                  payload_size);
+            return AVERROR_INVALIDDATA;
+        }
     }
+
+    if (payload_size * 8 > get_bits_left(gb)) {
+        av_log(s->avctx, AV_LOG_ERROR,
+               "SEI payload size too large.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (s->nal_unit_type == NAL_SEI_PREFIX) {
         switch (payload_type) {
         case 256:  // Mismatched value from HM 8.1
@@ -147,7 +160,7 @@ static int decode_nal_sei_message(HEVCContext *s)
             return decode_nal_sei_display_orientation(s);
         default:
             av_log(s->avctx, AV_LOG_DEBUG, "Skipped PREFIX SEI %d\n", 
payload_type);
-            skip_bits(gb, 8 * payload_size);
+            skip_bits_long(gb, 8 * payload_size);
             return 0;
         }
     } else { /* nal_unit_type == NAL_SEI_SUFFIX */
@@ -156,7 +169,7 @@ static int decode_nal_sei_message(HEVCContext *s)
             return decode_nal_sei_decoded_picture_hash(s);
         default:
             av_log(s->avctx, AV_LOG_DEBUG, "Skipped SUFFIX SEI %d\n", 
payload_type);
-            skip_bits(gb, 8 * payload_size);
+            skip_bits_long(gb, 8 * payload_size);
             return 0;
         }
     }
-- 
2.3.2

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel