diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-04 09:51:26 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2020-01-06 11:30:42 +0100 |
| commit | 3f57ece8e6071eef1c71b90164b59ac1b12d8bae (patch) | |
| tree | ee0954c5bf85de5aac2233470a7571810aef6c5c /libavcodec/cbs_av1_syntax_template.c | |
| parent | 10198572ce72d4964edb70372c7f28e91b484b62 (diff) | |
| download | ffmpeg-3f57ece8e6071eef1c71b90164b59ac1b12d8bae.tar.gz | |
avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]'
Fixes: 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
See: [FFmpeg-devel] [PATCH 05/13] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8174e5c77d8a94b57b6b1bcbb90728cf8b08ab6b)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cbs_av1_syntax_template.c')
| -rw-r--r-- | libavcodec/cbs_av1_syntax_template.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c index 76eb90b279..1ac0c1dcb9 100644 --- a/libavcodec/cbs_av1_syntax_template.c +++ b/libavcodec/cbs_av1_syntax_template.c @@ -419,16 +419,17 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw, for (i = 0; i < AV1_REFS_PER_FRAME; i++) { flags(found_ref[i], 1, i); if (current->found_ref[i]) { - AV1ReferenceFrameState *ref = - &priv->ref[current->ref_frame_idx[i]]; + AV1ReferenceFrameState *ref; - if (!ref->valid) { + if (current->ref_frame_idx[i] < 0 || + !priv->ref[current->ref_frame_idx[i]].valid) { av_log(ctx->log_ctx, AV_LOG_ERROR, "Missing reference frame needed for frame size " "(ref = %d, ref_frame_idx = %d).\n", i, current->ref_frame_idx[i]); return AVERROR_INVALIDDATA; } + ref = &priv->ref[current->ref_frame_idx[i]]; priv->upscaled_width = ref->upscaled_width; priv->frame_width = ref->frame_width; |