moonlight-stream/moonlight-qt
1
0
Fork 0
mirror of https://github.com/moonlight-stream/moonlight-qt.git synced 2026-10-18 14:35:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Clamp additional values that can be used as array indices

Browse Source 
These aren't exploitable in moonlight due to clamping done on the read side.
This commit is contained in:
Cameron Gutman
2026-10-14 01:09:54 -05:00
parent 71c3191e0c
commit fa6ae80940
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
h264bitstream/h264_stream.c
+10
View File
@@ -384,6 +384,11 @@ void write_seq_parameter_set_rbsp(sps_t* sps, bs_t* b)
}
else if( sps->pic_order_cnt_type == 1 )
{
if (sps->num_ref_frames_in_pic_order_cnt_cycle > 256)
{
sps->num_ref_frames_in_pic_order_cnt_cycle = 256;
}
bs_write_u1(b, sps->delta_pic_order_always_zero_flag);
bs_write_se(b, sps->offset_for_non_ref_pic);
bs_write_se(b, sps->offset_for_top_to_bottom_field);
@@ -529,6 +534,11 @@ void write_vui_parameters(sps_t* sps, bs_t* b)
void write_hrd_parameters(hrd_t* hrd, bs_t* b)
{
if (hrd->cpb_cnt_minus1 > 31)
{
hrd->cpb_cnt_minus1 = 31;
}
bs_write_ue(b, hrd->cpb_cnt_minus1);
bs_write_u(b, 4, hrd->bit_rate_scale);
bs_write_u(b, 4, hrd->cpb_size_scale);