diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-04-22 03:23:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-04-24 02:52:17 +0200 |
| commit | b91e3c4c908228901b1ec120d59ddf5a86c3b3b8 (patch) | |
| tree | 8dd53ce1991a089183d8ad0273317f32677480ea /libavcodec | |
| parent | 02301017d28422e4d0a4badb16f2226e70ec534a (diff) | |
| download | ffmpeg-b91e3c4c908228901b1ec120d59ddf5a86c3b3b8.tar.gz | |
avcodec/cbs_h2645: Check NAL space
Found-by-reviewing: CID1419833 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cbs_h2645.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index fe2e383ff3..1a45d424ba 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -709,7 +709,11 @@ static int cbs_h2645_split_fragment(CodedBitstreamContext *ctx, start = bytestream2_tell(&gbc); for(i = 0; i < num_nalus; i++) { + if (bytestream2_get_bytes_left(&gbc) < 2) + return AVERROR_INVALIDDATA; size = bytestream2_get_be16(&gbc); + if (bytestream2_get_bytes_left(&gbc) < size) + return AVERROR_INVALIDDATA; bytestream2_skip(&gbc, size); } end = bytestream2_tell(&gbc); |