From b33ba2f264c8e39c7794e7452b7b57d48fab3f13 Mon Sep 17 00:00:00 2001 From: Seungha Yang Date: Sat, 15 Mar 2025 22:39:44 +0900 Subject: [PATCH] h265parser: Fix max_dec_pic_buffering_minus1 bound check Allowed max value is MaxDpbSize - 1 Part-of: --- .../gst-libs/gst/codecparsers/gsth265parser.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c index 3870c32a32..1a319347f4 100644 --- a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c +++ b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c @@ -70,6 +70,8 @@ #include #include +#define MAX_DPB_SIZE 16 + #ifndef GST_DISABLE_GST_DEBUG #define GST_CAT_DEFAULT gst_h265_debug_category_get() static GstDebugCategory * @@ -1894,7 +1896,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps) for (i = (vps->sub_layer_ordering_info_present_flag ? 0 : vps->max_sub_layers_minus1); i <= vps->max_sub_layers_minus1; i++) { - READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], G_MAXUINT32 - 1); + READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1); READ_UE_MAX (&nr, vps->max_num_reorder_pics[i], vps->max_dec_pic_buffering_minus1[i]); READ_UE_MAX (&nr, vps->max_latency_increase_plus1[i], G_MAXUINT32 - 1); @@ -2081,7 +2083,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu, for (i = (sps->sub_layer_ordering_info_present_flag ? 0 : sps->max_sub_layers_minus1); i <= sps->max_sub_layers_minus1; i++) { - READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], 16); + READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1); READ_UE_MAX (&nr, sps->max_num_reorder_pics[i], sps->max_dec_pic_buffering_minus1[i]); READ_UE_MAX (&nr, sps->max_latency_increase_plus1[i], G_MAXUINT32 - 1);