virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/vp9_superframe_split_bsf: Don't read inexistent data

Browse Source 
Fixes: Out of array read
Fixes: 45137/clusterfuzz-testcase-minimized-ffmpeg_BSF_VP9_SUPERFRAME_SPLIT_fuzzer-4984270639202304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-03-22 23:50:54 +01:00
parent d20ef30f53
commit d311d820a7
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/vp9_superframe_split_bsf.c
View File

@ -51,6 +51,9 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, AVPacket *out)
return ret; return ret;
in = s->buffer_pkt; in = s->buffer_pkt;
if (!in->size)
goto passthrough;
marker = in->data[in->size - 1]; marker = in->data[in->size - 1];
if ((marker & 0xe0) == 0xc0) { if ((marker & 0xe0) == 0xc0) {
int length_size = 1 + ((marker >> 3) & 0x3); int length_size = 1 + ((marker >> 3) & 0x3);
@ -121,6 +124,7 @@ static int vp9_superframe_split_filter(AVBSFContext *ctx, AVPacket *out)
out->pts = AV_NOPTS_VALUE; out->pts = AV_NOPTS_VALUE;
} else { } else {
passthrough:
av_packet_move_ref(out, s->buffer_pkt); av_packet_move_ref(out, s->buffer_pkt);
} }