ffmpeg/libavcodec
James Almer fd4121a0aa avcodec/av1: only set the private context pix_fmt field if get_pixel_format() succeeds
Otherwise get_pixel_format() will not be called when parsing a subsequent Sequence
Header in non hwaccel enabled scenarios, allowing frame parsing when it shouldn't.

This prevents the scenario seqhdr -> frame_hdr/redundant_frame_hdr -> seqhdr ->
redundant_frame_hdr from having the latter redundant frame header parsed as if it
was a frame header by the decoder because the former was discarded.
Since CBS did not discard it, the latter redundant frame header is output with a
zeroed AV1RawFrameHeader struct, which can have undesired results, like division
by zero with fields normally guaranteed to be anything else.

Fixes: division by zero
Fixes: 43769/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5392562205097984
Fixes: 43950/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-5769210217758720

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 5670eddf8cd3907f9c0a9e626b5698d27c81c81b)
2022-03-28 20:36:04 -03:00
..
2022-03-28 23:18:56 +02:00
2022-01-04 13:16:49 +01:00
2022-01-04 13:16:49 +01:00
2022-01-04 12:08:18 +01:00
2022-01-04 12:08:18 +01:00
2021-12-03 16:09:14 +01:00
2021-12-03 16:09:14 +01:00
2022-03-28 23:18:56 +02:00