diff options
| author | Andriy Gelman <andriy.gelman@gmail.com> | 2019-12-06 11:03:02 -0500 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2019-12-11 22:18:48 -0300 |
| commit | 0493699813ccff57f9ac317afdc1c8be97cc64f5 (patch) | |
| tree | 8f29aca8183e45f4f8301ada7fdc94d626ae0d9e | |
| parent | 2722fc2bcfae03feea131737f7da451358a05a7b (diff) | |
| download | ffmpeg-0493699813ccff57f9ac317afdc1c8be97cc64f5.tar.gz | |
lavc/cbs_h2645: Fix incorrect max size of nalu unit
In the worst case the startcode prefix has 4 bytes.
This fixes a trigerred assertion:
Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451
Found-by:libFuzzer
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
(cherry picked from commit 02a83e26de6a58523ee55cfebc1312e7a4e42724)
| -rw-r--r-- | libavcodec/cbs_h2645.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index c95f1308e9..c3cb88d9c6 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -1454,7 +1454,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, max_size = 0; for (i = 0; i < frag->nb_units; i++) { // Start code + content with worst-case emulation prevention. - max_size += 3 + frag->units[i].data_size * 3 / 2; + max_size += 4 + frag->units[i].data_size * 3 / 2; } data = av_malloc(max_size + AV_INPUT_BUFFER_PADDING_SIZE); |