diff options
| author | Zhao Zhili <zhilizhao@tencent.com> | 2024-03-25 16:09:00 +0800 |
|---|---|---|
| committer | Zhao Zhili <zhilizhao@tencent.com> | 2024-03-27 20:04:40 +0800 |
| commit | 89e9486bc3da83ae031313c4b0224a7b46e83ab6 (patch) | |
| tree | d468d59ec47448cbb4a7ff8128c98b6b1bf86c1c /libavutil/ffmath.h | |
| parent | edb1f1bc09c7dd89d35da670d8b1f4366003df59 (diff) | |
| download | ffmpeg-89e9486bc3da83ae031313c4b0224a7b46e83ab6.tar.gz | |
avcodec/h264_mp4toannexb: Fix heap buffer overflow
Fixes: out of array write
Fixes: 64407/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_MP4TOANNEXB_fuzzer-4966763443650560
mp4toannexb_filter counts the number of bytes needed in the first
pass and allocate the memory, then do memcpy in the second pass.
Update sps/pps size in the loop makes the count invalid in the
case of SPS/PPS occur after IDR slice. This patch process in-band
SPS/PPS before the two pass loops.
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
Diffstat (limited to 'libavutil/ffmath.h')
0 files changed, 0 insertions, 0 deletions