diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-06-18 23:50:19 +0200 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2023-06-19 16:00:55 -0300 |
| commit | 89f98acbf8dd84cfcd357cc67e8e8b8c25f98a38 (patch) | |
| tree | d20b88d1a55139db99a48f321413e2ed1fe02bbe /libavcodec/evc_ps.c | |
| parent | 921596e677e7b3617f70a21d7188f8bc0f314328 (diff) | |
| download | ffmpeg-89f98acbf8dd84cfcd357cc67e8e8b8c25f98a38.tar.gz | |
avcodec/evc_ps: Check log2_sub_gop_length
Fixes: 1.70141e+38 is outside the range of representable values of type 'int'
Fixes: 59883/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5557887217565696
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavcodec/evc_ps.c')
| -rw-r--r-- | libavcodec/evc_ps.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c index b8d7329b94..0b8cc81d49 100644 --- a/libavcodec/evc_ps.c +++ b/libavcodec/evc_ps.c @@ -229,6 +229,10 @@ int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size) if (!sps->sps_pocs_flag || !sps->sps_rpl_flag) { sps->log2_sub_gop_length = get_ue_golomb(&gb); + if (sps->log2_sub_gop_length > 5U) { + ret = AVERROR_INVALIDDATA; + goto fail; + } if (sps->log2_sub_gop_length == 0) sps->log2_ref_pic_gap_length = get_ue_golomb(&gb); } @@ -288,6 +292,9 @@ int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size) ps->sps[sps_seq_parameter_set_id] = sps; return 0; +fail: + av_free(sps); + return ret; } // @see ISO_IEC_23094-1 (7.3.2.2 SPS RBSP syntax) |