You've already forked FFmpeg
mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-07-11 14:30:22 +02:00
lavc/cbs_h2645: Fix incorrect max size of nalu unit
In the worst case the startcode prefix has 4 bytes. This fixes a trigerred assertion: Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 Found-by:libFuzzer Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
This commit is contained in:
committed by
James Almer
parent
79d907774d
commit
02a83e26de
@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
|
|||||||
max_size = 0;
|
max_size = 0;
|
||||||
for (i = 0; i < frag->nb_units; i++) {
|
for (i = 0; i < frag->nb_units; i++) {
|
||||||
// Start code + content with worst-case emulation prevention.
|
// Start code + content with worst-case emulation prevention.
|
||||||
max_size += 3 + frag->units[i].data_size * 3 / 2;
|
max_size += 4 + frag->units[i].data_size * 3 / 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
|
data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
|
||||||
|
Reference in New Issue
Block a user