From 4a162aa46bca2b5ee477080b02c4ea8375b4d877 Mon Sep 17 00:00:00 2001 From: dancingmirrors Date: Sun, 5 Jul 2026 03:17:04 -0600 Subject: [PATCH] hasvk: Range check and fail the parse upon lost bit alignment in the slice parser. Assisted-by: Claude --- src/intel/vulkan_hasvk/anv_video_h264_slice.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/intel/vulkan_hasvk/anv_video_h264_slice.c b/src/intel/vulkan_hasvk/anv_video_h264_slice.c index 6a264a3..40237da 100644 --- a/src/intel/vulkan_hasvk/anv_video_h264_slice.c +++ b/src/intel/vulkan_hasvk/anv_video_h264_slice.c @@ -529,6 +529,14 @@ anv_h264_parse_slice_header( } } + /* Let the caller fall back to concealment if the parser lost bit-alignment. */ + if (out->slice_alpha_c0_offset_div2 < -6 || out->slice_alpha_c0_offset_div2 > 6 || + out->slice_beta_offset_div2 < -6 || out->slice_beta_offset_div2 > 6 || + out->slice_qp_delta < -51 || out->slice_qp_delta > 51 || + out->disable_deblocking_filter_idc > 2 || + out->cabac_init_idc > 2) + st.error = true; + VALID_RBSP_OR_BAIL(st) if (pps->flags.entropy_coding_mode_flag) {