diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-04 22:33:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-07-19 15:26:37 +0200 |
| commit | ba3a4a94bcedb10237540d859519d16900cb6b67 (patch) | |
| tree | 9ad38bb54508c60eb54b98d7f8d442eac5cd7478 | |
| parent | fb55620369845c057183993a14d8bd85633c2ff3 (diff) | |
| download | ffmpeg-ba3a4a94bcedb10237540d859519d16900cb6b67.tar.gz | |
avcodec/hevcdec: do not let updated extradata corrupt state
Fixes: out of array access
Fixes: 2451/clusterfuzz-testcase-minimized-4781613957251072
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Hendrik Leppkes <h.leppkes@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c8cfbc6629c1fe5755b59a3bcfd95ad08b843a07)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/hevcdec.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c index f673b08c15..5579a4df43 100644 --- a/libavcodec/hevcdec.c +++ b/libavcodec/hevcdec.c @@ -2995,7 +2995,7 @@ static int verify_md5(HEVCContext *s, AVFrame *frame) return 0; } -static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length) +static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length, int first) { AVCodecContext *avctx = s->avctx; GetByteContext gb; @@ -3057,7 +3057,7 @@ static int hevc_decode_extradata(HEVCContext *s, uint8_t *buf, int length) /* export stream parameters from the first SPS */ for (i = 0; i < FF_ARRAY_ELEMS(s->ps.sps_list); i++) { - if (s->ps.sps_list[i]) { + if (first && s->ps.sps_list[i]) { const HEVCSPS *sps = (const HEVCSPS*)s->ps.sps_list[i]->data; export_stream_params(s->avctx, &s->ps, sps); break; @@ -3087,7 +3087,7 @@ static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output, new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, &new_extradata_size); if (new_extradata && new_extradata_size > 0) { - ret = hevc_decode_extradata(s, new_extradata, new_extradata_size); + ret = hevc_decode_extradata(s, new_extradata, new_extradata_size, 0); if (ret < 0) return ret; } @@ -3370,7 +3370,7 @@ static av_cold int hevc_decode_init(AVCodecContext *avctx) s->threads_number = 1; if (avctx->extradata_size > 0 && avctx->extradata) { - ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size); + ret = hevc_decode_extradata(s, avctx->extradata, avctx->extradata_size, 1); if (ret < 0) { hevc_decode_free(avctx); return ret; |