From 8d0543e3ee17619ac70c67d46b4c9deed9b77598 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Wed, 23 Nov 2016 10:52:05 +0200 Subject: [PATCH 2/4] h265parse: Ensure codec_data has the required size when reading number of NAL arrays https://bugzilla.gnome.org/show_bug.cgi?id=774896 --- gst/videoparsers/gsth265parse.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/gst/videoparsers/gsth265parse.c b/gst/videoparsers/gsth265parse.c index 9a98dcc..483f299 100644 --- a/gst/videoparsers/gsth265parse.c +++ b/gst/videoparsers/gsth265parse.c @@ -1767,6 +1767,7 @@ gst_h265_parse_set_caps (GstBaseParse * parse, GstCaps * caps) (value = gst_structure_get_value (str, "codec_data"))) { GstMapInfo map; guint8 *data; + guint num_nal_arrays; GST_DEBUG_OBJECT (h265parse, "have packetized h265"); /* make note for optional split processing */ @@ -1795,8 +1796,15 @@ gst_h265_parse_set_caps (GstBaseParse * parse, GstCaps * caps) GST_DEBUG_OBJECT (h265parse, "nal length size %u", h265parse->nal_length_size); + num_nal_arrays = data[22]; off = 23; - for (i = 0; i < data[22]; i++) { + + for (i = 0; i < num_nal_arrays; i++) { + if (off + 3 >= size) { + gst_buffer_unmap (codec_data, &map); + goto hvcc_too_small; + } + num_nals = GST_READ_UINT16_BE (data + off + 1); for (j = 0; j < num_nals; j++) { parseres = gst_h265_parser_identify_nalu_hevc (h265parse->nalparser, -- 2.9.3