avcodec/dovi_rpudec: validate L2.ms_weight

This is specified to be in the range -1 to 4095, apparently the only extension level with such a restriction.
7 months ago · 954f890f95
parent e07b735a99
commit 954f890f95
1 changed files with 4 additions and 0 deletions
--- a/libavcodec/dovi_rpudec.c
+++ b/libavcodec/dovi_rpudec.c
@ -143,6 +143,7 @@ static int parse_ext_v1(DOVIContext *s, GetBitContext *gb, AVDOVIDmData *dm)
        dm->l2.trim_chroma_weight = get_bits(gb, 12);
        dm->l2.trim_saturation_gain = get_bits(gb, 12);
        dm->l2.ms_weight = get_sbits(gb, 13);
+        VALIDATE(dm->l2.ms_weight, -1, 4095);
        break;
    case 4:
        dm->l4.anchor_pq = get_bits(gb, 12);
@ -172,6 +173,9 @@ static int parse_ext_v1(DOVIContext *s, GetBitContext *gb, AVDOVIDmData *dm)
    }

    return 0;
+
+fail:
+    return AVERROR_INVALIDDATA;
 }

 static AVCIExy get_cie_xy(GetBitContext *gb)