virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-04-19 09:02:26 +02:00
Code Issues Releases Activity

avcodec/hevcdec: do not let updated extradata corrupt state

Browse Source 
Fixes: out of array access
Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8cfbc6629c1fe5755b59a3bcfd95ad08b843a07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-07-04 22:33:52 +02:00
parent fb55620369
commit ba3a4a94bc
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/hevcdec.c
View File

@ -2995,7 +2995,7 @@ static int verify_md5(HEVCContext *s, AVFrame *frame)
return 0; return 0;
} }
static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length) static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int first)
{ {
AVCodecContext *avctx = s->avctx; AVCodecContext *avctx = s->avctx;
GetByteContext gb; GetByteContext gb;
@ -3057,7 +3057,7 @@ static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
/* export stream parameters from the first SPS */ /* export stream parameters from the first SPS */
for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) { for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) {
if (s->ps.sps_list[i]) { if (first && s->ps.sps_list[i]) {
const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data; const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data;
export_stream_params(s->avctx, &s->ps, sps); export_stream_params(s->avctx, &s->ps, sps);
break; break;
@ -3087,7 +3087,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output,
new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
&new_extradata_size); &new_extradata_size);
if (new_extradata && new_extradata_size > 0) { if (new_extradata && new_extradata_size > 0) {
ret = hevc_decode_extradata(s, new_extradata, new_extradata_size); ret = hevc_decode_extradata(s, new_extradata, new_extradata_size, 0);
if (ret < 0) if (ret < 0)
return ret; return ret;
} }
@ -3370,7 +3370,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
s->threads_number = 1; s->threads_number = 1;
if (avctx->extradata_size > 0 && avctx->extradata) { if (avctx->extradata_size > 0 && avctx->extradata) {
ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size); ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size, 1);
if (ret < 0) { if (ret < 0) {
hevc_decode_free(avctx); hevc_decode_free(avctx);
return ret; return ret;