virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

Browse Source 
Fixes: out of array access
Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-09-14 22:27:46 +02:00
parent 87cf1be905
commit 120f74650d
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
libavcodec/evc_ps.c
View File

@ -57,6 +57,9 @@ static int ref_pic_list_struct(const EVCParserSPS *sps, GetBitContext *gb, RefPi
static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
{
hrd->cpb_cnt_minus1 = get_ue_golomb_31(gb);
if (hrd->cpb_cnt_minus1 >= FF_ARRAY_ELEMS(hrd->cpb_size_value_minus1))
return AVERROR_INVALIDDATA;
hrd->bit_rate_scale = get_bits(gb, 4);
hrd->cpb_size_scale = get_bits(gb, 4);
for (int SchedSelIdx = 0; SchedSelIdx <= hrd->cpb_cnt_minus1; SchedSelIdx++) {
@ -75,6 +78,8 @@ static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
// @see ISO_IEC_23094-1 (E.2.1 VUI parameters syntax)
static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
{
int ret;
vui->aspect_ratio_info_present_flag = get_bits(gb, 1);
if (vui->aspect_ratio_info_present_flag) {
vui->aspect_ratio_idc = get_bits(gb, 8);
@ -113,11 +118,18 @@ static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
vui->fixed_pic_rate_flag = get_bits(gb, 1);
}
vui->nal_hrd_parameters_present_flag = get_bits(gb, 1);
if (vui->nal_hrd_parameters_present_flag)
hrd_parameters(gb, &vui->hrd_parameters);
if (vui->nal_hrd_parameters_present_flag) {
ret = hrd_parameters(gb, &vui->hrd_parameters);
if (ret < 0)
return ret;
}
vui->vcl_hrd_parameters_present_flag = get_bits(gb, 1);
if (vui->vcl_hrd_parameters_present_flag)
hrd_parameters(gb, &vui->hrd_parameters);
if (vui->vcl_hrd_parameters_present_flag) {
ret = hrd_parameters(gb, &vui->hrd_parameters);
if (ret < 0)
return ret;
}
if (vui->nal_hrd_parameters_present_flag || vui->vcl_hrd_parameters_present_flag)
vui->low_delay_hrd_flag = get_bits(gb, 1);
vui->pic_struct_present_flag = get_bits(gb, 1);
@ -304,8 +316,11 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
}
sps->vui_parameters_present_flag = get_bits1(gb);
if (sps->vui_parameters_present_flag)
vui_parameters(gb, &(sps->vui_parameters));
if (sps->vui_parameters_present_flag) {
ret = vui_parameters(gb, &(sps->vui_parameters));
if (ret < 0)
goto fail;
}
// @note
// If necessary, add the missing fields to the EVCParserSPS structure