mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-07 11:13:41 +02:00
2c96e6cb95
The top-level GetBitContext is sized for the whole NAL unit, so it fails to detect overflows where a payload continues into the following message. To fix that, we make a new context on the stack for reading each payload. Fixes: 29892/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-6310830956216320 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Tested-by: Michael Niedermayer <michael@niedermayer.cc>
323 lines
9.2 KiB
C
323 lines
9.2 KiB
C
/*
|
|
* This file is part of FFmpeg.
|
|
*
|
|
* FFmpeg is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* FFmpeg is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with FFmpeg; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
static int FUNC(filler_payload)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawFillerPayload *current, SEIMessageState *state)
|
|
{
|
|
int err, i;
|
|
|
|
HEADER("Filler Payload");
|
|
|
|
#ifdef READ
|
|
current->payload_size = state->payload_size;
|
|
#endif
|
|
|
|
for (i = 0; i < current->payload_size; i++)
|
|
fixed(8, ff_byte, 0xff);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(user_data_registered)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawUserDataRegistered *current, SEIMessageState *state)
|
|
{
|
|
int err, i, j;
|
|
|
|
HEADER("User Data Registered ITU-T T.35");
|
|
|
|
u(8, itu_t_t35_country_code, 0x00, 0xff);
|
|
if (current->itu_t_t35_country_code != 0xff)
|
|
i = 1;
|
|
else {
|
|
u(8, itu_t_t35_country_code_extension_byte, 0x00, 0xff);
|
|
i = 2;
|
|
}
|
|
|
|
#ifdef READ
|
|
if (state->payload_size < i) {
|
|
av_log(ctx->log_ctx, AV_LOG_ERROR,
|
|
"Invalid SEI user data registered payload.\n");
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
current->data_length = state->payload_size - i;
|
|
#endif
|
|
|
|
allocate(current->data, current->data_length);
|
|
for (j = 0; j < current->data_length; j++)
|
|
xu(8, itu_t_t35_payload_byte[], current->data[j], 0x00, 0xff, 1, i + j);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(user_data_unregistered)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawUserDataUnregistered *current, SEIMessageState *state)
|
|
{
|
|
int err, i;
|
|
|
|
HEADER("User Data Unregistered");
|
|
|
|
#ifdef READ
|
|
if (state->payload_size < 16) {
|
|
av_log(ctx->log_ctx, AV_LOG_ERROR,
|
|
"Invalid SEI user data unregistered payload.\n");
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
current->data_length = state->payload_size - 16;
|
|
#endif
|
|
|
|
for (i = 0; i < 16; i++)
|
|
us(8, uuid_iso_iec_11578[i], 0x00, 0xff, 1, i);
|
|
|
|
allocate(current->data, current->data_length);
|
|
|
|
for (i = 0; i < current->data_length; i++)
|
|
xu(8, user_data_payload_byte[i], current->data[i], 0x00, 0xff, 1, i);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(mastering_display_colour_volume)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawMasteringDisplayColourVolume *current, SEIMessageState *state)
|
|
{
|
|
int err, c;
|
|
|
|
HEADER("Mastering Display Colour Volume");
|
|
|
|
for (c = 0; c < 3; c++) {
|
|
ubs(16, display_primaries_x[c], 1, c);
|
|
ubs(16, display_primaries_y[c], 1, c);
|
|
}
|
|
|
|
ub(16, white_point_x);
|
|
ub(16, white_point_y);
|
|
|
|
ub(32, max_display_mastering_luminance);
|
|
ub(32, min_display_mastering_luminance);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(content_light_level_info)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawContentLightLevelInfo *current, SEIMessageState *state)
|
|
{
|
|
int err;
|
|
|
|
HEADER("Content Light Level Information");
|
|
|
|
ub(16, max_content_light_level);
|
|
ub(16, max_pic_average_light_level);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(alternative_transfer_characteristics)
|
|
(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawAlternativeTransferCharacteristics *current,
|
|
SEIMessageState *state)
|
|
{
|
|
int err;
|
|
|
|
HEADER("Alternative Transfer Characteristics");
|
|
|
|
ub(8, preferred_transfer_characteristics);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(message)(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawMessage *current)
|
|
{
|
|
const SEIMessageTypeDescriptor *desc;
|
|
int err, i;
|
|
|
|
desc = ff_cbs_sei_find_type(ctx, current->payload_type);
|
|
if (desc) {
|
|
SEIMessageState state = {
|
|
.payload_type = current->payload_type,
|
|
.payload_size = current->payload_size,
|
|
.extension_present = current->extension_bit_length > 0,
|
|
};
|
|
int start_position, current_position, bits_written;
|
|
|
|
#ifdef READ
|
|
CHECK(ff_cbs_sei_alloc_message_payload(current, desc));
|
|
#endif
|
|
|
|
start_position = bit_position(rw);
|
|
|
|
CHECK(desc->READWRITE(ctx, rw, current->payload, &state));
|
|
|
|
current_position = bit_position(rw);
|
|
bits_written = current_position - start_position;
|
|
|
|
if (byte_alignment(rw) || state.extension_present ||
|
|
bits_written < 8 * current->payload_size) {
|
|
size_t bits_left;
|
|
|
|
#ifdef READ
|
|
GetBitContext tmp = *rw;
|
|
int trailing_bits, trailing_zero_bits;
|
|
|
|
bits_left = 8 * current->payload_size - bits_written;
|
|
if (bits_left > 8)
|
|
skip_bits_long(&tmp, bits_left - 8);
|
|
trailing_bits = get_bits(&tmp, FFMIN(bits_left, 8));
|
|
if (trailing_bits == 0) {
|
|
// The trailing bits must contain a bit_equal_to_one, so
|
|
// they can't all be zero.
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
trailing_zero_bits = ff_ctz(trailing_bits);
|
|
current->extension_bit_length =
|
|
bits_left - 1 - trailing_zero_bits;
|
|
#endif
|
|
|
|
if (current->extension_bit_length > 0) {
|
|
allocate(current->extension_data,
|
|
(current->extension_bit_length + 7) / 8);
|
|
|
|
bits_left = current->extension_bit_length;
|
|
for (i = 0; bits_left > 0; i++) {
|
|
int length = FFMIN(bits_left, 8);
|
|
xu(length, reserved_payload_extension_data,
|
|
current->extension_data[i],
|
|
0, MAX_UINT_BITS(length), 0);
|
|
bits_left -= length;
|
|
}
|
|
}
|
|
|
|
fixed(1, bit_equal_to_one, 1);
|
|
while (byte_alignment(rw))
|
|
fixed(1, bit_equal_to_zero, 0);
|
|
}
|
|
|
|
#ifdef WRITE
|
|
current->payload_size = (put_bits_count(rw) - start_position) / 8;
|
|
#endif
|
|
} else {
|
|
uint8_t *data;
|
|
|
|
allocate(current->payload, current->payload_size);
|
|
data = current->payload;
|
|
|
|
for (i = 0; i < current->payload_size; i++)
|
|
xu(8, payload_byte[i], data[i], 0, 255, 1, i);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int FUNC(message_list)(CodedBitstreamContext *ctx, RWContext *rw,
|
|
SEIRawMessageList *current, int prefix)
|
|
{
|
|
SEIRawMessage *message;
|
|
int err, k;
|
|
|
|
#ifdef READ
|
|
for (k = 0;; k++) {
|
|
uint32_t payload_type = 0;
|
|
uint32_t payload_size = 0;
|
|
uint32_t tmp;
|
|
GetBitContext payload_gbc;
|
|
|
|
while (show_bits(rw, 8) == 0xff) {
|
|
fixed(8, ff_byte, 0xff);
|
|
payload_type += 255;
|
|
}
|
|
xu(8, last_payload_type_byte, tmp, 0, 254, 0);
|
|
payload_type += tmp;
|
|
|
|
while (show_bits(rw, 8) == 0xff) {
|
|
fixed(8, ff_byte, 0xff);
|
|
payload_size += 255;
|
|
}
|
|
xu(8, last_payload_size_byte, tmp, 0, 254, 0);
|
|
payload_size += tmp;
|
|
|
|
// There must be space remaining for both the payload and
|
|
// the trailing bits on the SEI NAL unit.
|
|
if (payload_size + 1 > get_bits_left(rw) / 8) {
|
|
av_log(ctx->log_ctx, AV_LOG_ERROR,
|
|
"Invalid SEI message: payload_size too large "
|
|
"(%"PRIu32" bytes).\n", payload_size);
|
|
return AVERROR_INVALIDDATA;
|
|
}
|
|
CHECK(init_get_bits(&payload_gbc, rw->buffer,
|
|
get_bits_count(rw) + 8 * payload_size));
|
|
skip_bits_long(&payload_gbc, get_bits_count(rw));
|
|
|
|
CHECK(ff_cbs_sei_list_add(current));
|
|
message = ¤t->messages[k];
|
|
|
|
message->payload_type = payload_type;
|
|
message->payload_size = payload_size;
|
|
|
|
CHECK(FUNC(message)(ctx, &payload_gbc, message));
|
|
|
|
skip_bits_long(rw, 8 * payload_size);
|
|
|
|
if (!cbs_h2645_read_more_rbsp_data(rw))
|
|
break;
|
|
}
|
|
#else
|
|
for (k = 0; k < current->nb_messages; k++) {
|
|
PutBitContext start_state;
|
|
uint32_t tmp;
|
|
int trace, i;
|
|
|
|
message = ¤t->messages[k];
|
|
|
|
// We write the payload twice in order to find the size. Trace
|
|
// output is switched off for the first write.
|
|
trace = ctx->trace_enable;
|
|
ctx->trace_enable = 0;
|
|
|
|
start_state = *rw;
|
|
for (i = 0; i < 2; i++) {
|
|
*rw = start_state;
|
|
|
|
tmp = message->payload_type;
|
|
while (tmp >= 255) {
|
|
fixed(8, ff_byte, 0xff);
|
|
tmp -= 255;
|
|
}
|
|
xu(8, last_payload_type_byte, tmp, 0, 254, 0);
|
|
|
|
tmp = message->payload_size;
|
|
while (tmp >= 255) {
|
|
fixed(8, ff_byte, 0xff);
|
|
tmp -= 255;
|
|
}
|
|
xu(8, last_payload_size_byte, tmp, 0, 254, 0);
|
|
|
|
err = FUNC(message)(ctx, rw, message);
|
|
ctx->trace_enable = trace;
|
|
if (err < 0)
|
|
return err;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|