From: Aaron Boxer <aaron.boxer@collabora.com>
Date: Fri, 3 Sep 2021 18:57:09 +0000 (-0400)
Subject: gsth264parser: reject memory management control op greater than 6
X-Git-Tag: 1.19.3~507^2~70
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=15d724e671bb6fb4018059a9ae7948d74fc78cb5;p=platform%2Fupstream%2Fgstreamer.git

gsth264parser: reject memory management control op greater than 6

This prevents assertion from being thrown in
gst_h264_dpb_perform_memory_management_control_operation
if corrupt NAL has a control op greater than 6

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/2508>
---

diff --git a/gst-libs/gst/codecparsers/gsth264parser.c b/gst-libs/gst/codecparsers/gsth264parser.c
index e1703c5..4aaced9 100644
--- a/gst-libs/gst/codecparsers/gsth264parser.c
+++ b/gst-libs/gst/codecparsers/gsth264parser.c
@@ -723,7 +723,7 @@ gst_h264_slice_parse_dec_ref_pic_marking (GstH264SliceHdr * slice,
 
       dec_ref_pic_m->n_ref_pic_marking = 0;
       while (1) {
-        READ_UE (nr, mem_mgmt_ctrl_op);
+        READ_UE_MAX (nr, mem_mgmt_ctrl_op, 6);
         if (mem_mgmt_ctrl_op == 0)
           break;