mirror of
https://git.videolan.org/git/ffmpeg.git
synced 2024-08-27 20:01:50 +02:00
avcodec/hevcdec: do not let updated extradata corrupt state
Fixes: out of array access Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
24bb7db403
commit
c8cfbc6629
@ -3057,7 +3057,7 @@ static int verify_md5(HEVCContext *s, AVFrame *frame)
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
|
||||
static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int first)
|
||||
{
|
||||
int ret, i;
|
||||
|
||||
@ -3069,7 +3069,7 @@ static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length)
|
||||
|
||||
/* export stream parameters from the first SPS */
|
||||
for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) {
|
||||
if (s->ps.sps_list[i]) {
|
||||
if (first && s->ps.sps_list[i]) {
|
||||
const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data;
|
||||
export_stream_params(s->avctx, &s->ps, sps);
|
||||
break;
|
||||
@ -3099,7 +3099,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output,
|
||||
new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
|
||||
&new_extradata_size);
|
||||
if (new_extradata && new_extradata_size > 0) {
|
||||
ret = hevc_decode_extradata(s, new_extradata, new_extradata_size);
|
||||
ret = hevc_decode_extradata(s, new_extradata, new_extradata_size, 0);
|
||||
if (ret < 0)
|
||||
return ret;
|
||||
}
|
||||
@ -3387,7 +3387,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx)
|
||||
s->threads_number = 1;
|
||||
|
||||
if (avctx->extradata_size > 0 && avctx->extradata) {
|
||||
ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size);
|
||||
ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size, 1);
|
||||
if (ret < 0) {
|
||||
hevc_decode_free(avctx);
|
||||
return ret;
|
||||
|
Loading…
Reference in New Issue
Block a user