diff options
| author | Aman Gupta <aman@tmm1.net> | 2018-10-05 11:36:51 -0700 |
|---|---|---|
| committer | Aman Gupta <aman@tmm1.net> | 2018-10-16 11:54:52 -0700 |
| commit | 8791a1e7de35d84fc12cc1a3adb131f5ad888245 (patch) | |
| tree | ee62229be585f7f1b2462f46a5c30d80405d2bae | |
| parent | 70d0d83d4d61f4c85ff4fe75e24de94a27f61288 (diff) | |
| download | ffmpeg-8791a1e7de35d84fc12cc1a3adb131f5ad888245.tar.gz | |
avcodec/cbs: ensure user_data is padded for GBC parsing
Fixes crash noticed in the cbs_userdata patchset.
====ERROR: AddressSanitizer: heap-buffer-overflow on address 0x609000026c89 at pc 0x00010725d37b bp 0x7ffeea04e750 sp 0x7ffeea04e748
READ of size 4 at 0x609000026c89 thread T0
#0 0x10725d37a in ff_cbs_read_unsigned get_bits.h:274
#1 0x1072d2767 in ff_cbs_read_a53_user_data cbs_misc_syntax_template.c:119
#2 0x1078251a7 in h264_metadata_filter h264_metadata_bsf.c:595
#3 0x105c1321d in output_packet ffmpeg.c:853
0x609000026c89 is located 1 bytes to the right of 8-byte region [0x609000026c80,0x609000026c88)
allocated by thread T0 here:
#0 0x10aef08d7 in wrap_posix_memalign (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x578d7)
#1 0x10aca95e6 in av_malloc mem.c:87
#2 0x10ac545fe in av_buffer_allocz buffer.c:72
#3 0x107263b27 in cbs_h264_read_nal_unit cbs_h264_syntax_template.c:722
#4 0x10725b688 in cbs_read_fragment_content cbs.c:155
Signed-off-by: Aman Gupta <aman@tmm1.net>
(cherry picked from commit 41ed2c384993da0cbc69657f05bec3c9b21b78bf)
| -rw-r--r-- | libavcodec/cbs_h264_syntax_template.c | 2 | ||||
| -rw-r--r-- | libavcodec/cbs_mpeg2_syntax_template.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/cbs_h264_syntax_template.c b/libavcodec/cbs_h264_syntax_template.c index 834b44a091..29089e4b6c 100644 --- a/libavcodec/cbs_h264_syntax_template.c +++ b/libavcodec/cbs_h264_syntax_template.c @@ -656,7 +656,7 @@ static int FUNC(sei_user_data_registered)(CodedBitstreamContext *ctx, RWContext *payload_size = i + current->data_length; #endif - allocate(current->data, current->data_length); + allocate(current->data, current->data_length + AV_INPUT_BUFFER_PADDING_SIZE); for (j = 0; j < current->data_length; j++) xu(8, itu_t_t35_payload_byte, current->data[j], 0x00, 0xff); diff --git a/libavcodec/cbs_mpeg2_syntax_template.c b/libavcodec/cbs_mpeg2_syntax_template.c index 51c32cb58d..235f199e5a 100644 --- a/libavcodec/cbs_mpeg2_syntax_template.c +++ b/libavcodec/cbs_mpeg2_syntax_template.c @@ -71,7 +71,7 @@ static int FUNC(user_data)(CodedBitstreamContext *ctx, RWContext *rw, av_assert0(k % 8 == 0); current->user_data_length = k /= 8; if (k > 0) { - current->user_data_ref = av_buffer_alloc(k); + current->user_data_ref = av_buffer_allocz(k + AV_INPUT_BUFFER_PADDING_SIZE); if (!current->user_data_ref) return AVERROR(ENOMEM); current->user_data = current->user_data_ref->data; |