diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-17 01:15:02 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-08-18 23:05:28 +0200 |
| commit | 043875941fcf55fc0d1cdee15ccb84b45e17330c (patch) | |
| tree | 3e7e833cf72f69d4ff56b1eab88970e3521a63a9 /libavcodec/cbs_h265_syntax_template.c | |
| parent | 8657eb9c3f4a498389cb8725760d1793c08c57fc (diff) | |
| download | ffmpeg-043875941fcf55fc0d1cdee15ccb84b45e17330c.tar.gz | |
avcodec/cbs_h265_syntax_template:
Fixes: Assertion width > 0 && width <= 32 failed
Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/cbs_h265_syntax_template.c')
| -rw-r--r-- | libavcodec/cbs_h265_syntax_template.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index 12fa185c77..9f0281b8e8 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -2307,6 +2307,12 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_display_width[i] + (int)current->prec_ref_display_width - 31); + + if (length > 32) { + av_log(ctx->log_ctx, AV_LOG_ERROR, "refDispWidthBits > 32 is not supported\n"); + return AVERROR_PATCHWELCOME; + } + if (length) ubs(length, mantissa_ref_display_width[i], 1, i); else @@ -2318,6 +2324,12 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + (int)current->prec_ref_viewing_dist - 31); + + if (length > 32) { + av_log(ctx->log_ctx, AV_LOG_ERROR, "refViewDistBits > 32 is not supported\n"); + return AVERROR_PATCHWELCOME; + } + if (length) ubs(length, mantissa_ref_viewing_distance[i], 1, i); else |