highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

Browse Source 
Fixes: out of array access
Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2023-09-14 22:27:46 +02:00
parent 87cf1be905
commit 120f74650d
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
libavcodec/evc_ps.c
View File

@@ -57,6 +57,9 @@ static int ref_pic_list_struct(const EVCParserSPS *sps, GetBitContext *gb, RefPi
static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd) static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
{ {
hrd->cpb_cnt_minus1 = get_ue_golomb_31(gb); hrd->cpb_cnt_minus1 = get_ue_golomb_31(gb);
if (hrd->cpb_cnt_minus1 >= FF_ARRAY_ELEMS(hrd->cpb_size_value_minus1))
return AVERROR_INVALIDDATA;
hrd->bit_rate_scale = get_bits(gb, 4); hrd->bit_rate_scale = get_bits(gb, 4);
hrd->cpb_size_scale = get_bits(gb, 4); hrd->cpb_size_scale = get_bits(gb, 4);
for (int SchedSelIdx = 0; SchedSelIdx <= hrd->cpb_cnt_minus1; SchedSelIdx++) { for (int SchedSelIdx = 0; SchedSelIdx <= hrd->cpb_cnt_minus1; SchedSelIdx++) {
@@ -75,6 +78,8 @@ static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
// @see ISO_IEC_23094-1 (E.2.1 VUI parameters syntax) // @see ISO_IEC_23094-1 (E.2.1 VUI parameters syntax)
static int vui_parameters(GetBitContext *gb, VUIParameters *vui) static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
{ {
int ret;
vui->aspect_ratio_info_present_flag = get_bits(gb, 1); vui->aspect_ratio_info_present_flag = get_bits(gb, 1);
if (vui->aspect_ratio_info_present_flag) { if (vui->aspect_ratio_info_present_flag) {
vui->aspect_ratio_idc = get_bits(gb, 8); vui->aspect_ratio_idc = get_bits(gb, 8);
@@ -113,11 +118,18 @@ static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
vui->fixed_pic_rate_flag = get_bits(gb, 1); vui->fixed_pic_rate_flag = get_bits(gb, 1);
} }
vui->nal_hrd_parameters_present_flag = get_bits(gb, 1); vui->nal_hrd_parameters_present_flag = get_bits(gb, 1);
if (vui->nal_hrd_parameters_present_flag) if (vui->nal_hrd_parameters_present_flag) {
hrd_parameters(gb, &vui->hrd_parameters); ret = hrd_parameters(gb, &vui->hrd_parameters);
if (ret < 0)
return ret;
}
vui->vcl_hrd_parameters_present_flag = get_bits(gb, 1); vui->vcl_hrd_parameters_present_flag = get_bits(gb, 1);
if (vui->vcl_hrd_parameters_present_flag) if (vui->vcl_hrd_parameters_present_flag) {
hrd_parameters(gb, &vui->hrd_parameters); ret = hrd_parameters(gb, &vui->hrd_parameters);
if (ret < 0)
return ret;
}
if (vui->nal_hrd_parameters_present_flag || vui->vcl_hrd_parameters_present_flag) if (vui->nal_hrd_parameters_present_flag || vui->vcl_hrd_parameters_present_flag)
vui->low_delay_hrd_flag = get_bits(gb, 1); vui->low_delay_hrd_flag = get_bits(gb, 1);
vui->pic_struct_present_flag = get_bits(gb, 1); vui->pic_struct_present_flag = get_bits(gb, 1);
@@ -304,8 +316,11 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
} }
sps->vui_parameters_present_flag = get_bits1(gb); sps->vui_parameters_present_flag = get_bits1(gb);
if (sps->vui_parameters_present_flag) if (sps->vui_parameters_present_flag) {
vui_parameters(gb, &(sps->vui_parameters)); ret = vui_parameters(gb, &(sps->vui_parameters));
if (ret < 0)
goto fail;
}
// @note // @note
// If necessary, add the missing fields to the EVCParserSPS structure // If necessary, add the missing fields to the EVCParserSPS structure