[FFmpeg-cvslog] avcodec/hevc_ps: Check depth to be within 8 to 16

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Apr 16 23:55:56 2023 +0200| [cb8180aa66839fe05e3a29504fb2f67336312227] | committer: Michael Niedermayer

avcodec/hevc_ps: Check depth to be within 8 to 16

Fixes: assertion failure in bitreader
Fixes: 45982/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-627318668066816

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cb8180aa66839fe05e3a29504fb2f67336312227
---

 libavcodec/hevc_ps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/hevc_ps.c b/libavcodec/hevc_ps.c
index bba0ebd1dd..266adb6e86 100644
--- a/libavcodec/hevc_ps.c
+++ b/libavcodec/hevc_ps.c
@@ -1557,6 +1557,10 @@ static int pps_scc_extension(GetBitContext *gb, AVCodecContext *avctx,
             pps->luma_bit_depth_entry = get_ue_golomb_31(gb) + 8;
             if (!pps->monochrome_palette_flag)
                 pps->chroma_bit_depth_entry = get_ue_golomb_31(gb) + 8;
+
+            if (pps->chroma_bit_depth_entry > 16 || pps->chroma_bit_depth_entry > 16)
+                return AVERROR_INVALIDDATA;
+
             num_comps = pps->monochrome_palette_flag ? 1 : 3;
             for (int comp = 0; comp < num_comps; comp++) {
                 int bit_depth = !comp ? pps->luma_bit_depth_entry : pps->chroma_bit_depth_entry;