diff options
| author | James Almer <jamrial@gmail.com> | 2025-08-10 13:44:31 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2025-08-12 19:59:21 +0000 |
| commit | 4b39d776c39f3a049932c8be0d46f48a4a3a0a7c (patch) | |
| tree | dc4eb5ae84c6f89a51ceaca1e5edea31becf34e7 /libavcodec/cbs_apv_syntax_template.c | |
| parent | 0469d68acb52081ca8385b844b9650398242be0f (diff) | |
| download | ffmpeg-4b39d776c39f3a049932c8be0d46f48a4a3a0a7c.tar.gz | |
avcodec/cbs_apv: store derived tile information in a per frame basis
If a single fragment contains more than one frame unit, the tile information stored
in the private context will only correspond to one of them.
Fixes: crash (out of array access)
Fixes: 435489659/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_APV_fuzzer-6194885205229568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavcodec/cbs_apv_syntax_template.c')
| -rw-r--r-- | libavcodec/cbs_apv_syntax_template.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/cbs_apv_syntax_template.c b/libavcodec/cbs_apv_syntax_template.c index b84565b107..621595ffbf 100644 --- a/libavcodec/cbs_apv_syntax_template.c +++ b/libavcodec/cbs_apv_syntax_template.c @@ -128,10 +128,10 @@ static int FUNC(tile_info)(CodedBitstreamContext *ctx, RWContext *rw, ub(1, tile_size_present_in_fh_flag); - cbs_apv_derive_tile_info(&priv->tile_info, fh); + cbs_apv_derive_tile_info(ctx, fh); if (current->tile_size_present_in_fh_flag) { - for (int t = 0; t < priv->tile_info.num_tiles; t++) { + for (int t = 0; t < priv->num_tiles; t++) { us(32, tile_size_in_fh[t], 10, MAX_UINT_BITS(32), 1, t); } } @@ -262,7 +262,7 @@ static int FUNC(frame)(CodedBitstreamContext *ctx, RWContext *rw, CHECK(FUNC(frame_header)(ctx, rw, ¤t->frame_header)); - for (int t = 0; t < priv->tile_info.num_tiles; t++) { + for (int t = 0; t < priv->num_tiles; t++) { us(32, tile_size[t], 10, MAX_UINT_BITS(32), 1, t); CHECK(FUNC(tile)(ctx, rw, ¤t->tile[t], |