If slice_type is > 9, the access to ff_h264_golomb_to_pict_type is out-of-bounds. Fix this by simply setting the slice_type to 0 in this case. This is completely inconsequential because the value is only being used to being used as an offset in the calculation of the film grain seed value, a corruption of which is practically invisible. Fixes coverity ticket #1490802
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -533,10 +533,8 @@ static int get_last_needed_nal(H264Context *h) · 532 unmodified lines | |||
| 533 | first_slice != nal->type) | 533 | first_slice != nal->type) |
| 534 | nals_needed = i; | 534 | nals_needed = i; |
| 535 | slice_type = get_ue_golomb_31(&gb); | 535 | slice_type = get_ue_golomb_31(&gb); |
| 536 | if (slice_type > 9) { | 536 | if (slice_type > 9) |
| 537 | if (h->avctx->err_recognition & AV_EF_EXPLODE) | 537 | slice_type = 0; |
| 538 | return AVERROR_INVALIDDATA; | ||
| 539 | } | ||
| 540 | if (slice_type > 4) | 538 | if (slice_type > 4) |
| 541 | slice_type -= 5; | 539 | slice_type -= 5; |
| 542 | 540 | ||