Eyevinn / mp4ff / 37466737656

83%

push

github

fix(avc): reject out-of-range deblocking filter values in slice headers

ParseSliceHeader stored disable_deblocking_filter_idc, slice_alpha_c0_offset_div2 and slice_beta_offset_div2 without checking them. ISO/IEC 14496-10 7.4.3 limits the idc to 0..2 and the offsets to -6..+6. The offsets shift the indices into the deblocking filter tables (FilterOffsetA/B = offset << 1), so a decoder that trusts the parsed header can index those tables out of range. Fuzzing hi264 found a 35-byte stream with idc 5, alpha 24 and beta 771 that made its deblocking filter panic with index out of range [1619] with length 156. The idc is also checked before the uint32 conversion, so a huge value can no longer truncate to 1 and skip the offsets.

15 of 15 new or added lines in 1 file covered. (100.0%)

23809 of 28808 relevant lines covered (82.65%)

0.83 hits per line