| Message ID | 20191206160302.13606-1-andriy.gelman@gmail.com |
|---|---|
| State | Accepted |
| Commit | 02a83e26de6a58523ee55cfebc1312e7a4e42724 |
| Headers | show |
Andriy Gelman: > From: Andriy Gelman <andriy.gelman@gmail.com> > > In the worst case the startcode prefix has 4 bytes. > > This fixes a trigerred assertion: > Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 > > Found-by:libFuzzer > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > --- > libavcodec/cbs_h2645.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c > index 88fa0029cd6..5f71d805848 100644 > --- a/libavcodec/cbs_h2645.c > +++ b/libavcodec/cbs_h2645.c > @@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, > max_size = 0; > for (i = 0; i < frag->nb_units; i++) { > // Start code + content with worst-case emulation prevention. > - max_size += 3 + frag->units[i].data_size * 3 / 2; > + max_size += 4 + frag->units[i].data_size * 3 / 2; > } > > data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE); > LGTM. I presume you used a NAL unit of size 1? (I found this out, too, when I tried (and postponed) to add mp4 writing support for H.264.) - Andreas
On 12/6/2019 2:47 PM, Andreas Rheinhardt wrote: > Andriy Gelman: >> From: Andriy Gelman <andriy.gelman@gmail.com> >> >> In the worst case the startcode prefix has 4 bytes. >> >> This fixes a trigerred assertion: >> Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 >> >> Found-by:libFuzzer >> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> >> --- >> libavcodec/cbs_h2645.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c >> index 88fa0029cd6..5f71d805848 100644 >> --- a/libavcodec/cbs_h2645.c >> +++ b/libavcodec/cbs_h2645.c >> @@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, >> max_size = 0; >> for (i = 0; i < frag->nb_units; i++) { >> // Start code + content with worst-case emulation prevention. >> - max_size += 3 + frag->units[i].data_size * 3 / 2; >> + max_size += 4 + frag->units[i].data_size * 3 / 2; >> } >> >> data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE); >> > LGTM. I presume you used a NAL unit of size 1? Pushed then. Thanks. > > (I found this out, too, when I tried (and postponed) to add mp4 > writing support for H.264.) > > - Andreas > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". >
On Fri, 06. Dec 17:47, Andreas Rheinhardt wrote: > Andriy Gelman: > > From: Andriy Gelman <andriy.gelman@gmail.com> > > > > In the worst case the startcode prefix has 4 bytes. > > > > This fixes a trigerred assertion: > > Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 > > > > Found-by:libFuzzer > > Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com> > > --- > > libavcodec/cbs_h2645.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c > > index 88fa0029cd6..5f71d805848 100644 > > --- a/libavcodec/cbs_h2645.c > > +++ b/libavcodec/cbs_h2645.c > > @@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, > > max_size = 0; > > for (i = 0; i < frag->nb_units; i++) { > > // Start code + content with worst-case emulation prevention. > > - max_size += 3 + frag->units[i].data_size * 3 / 2; > > + max_size += 4 + frag->units[i].data_size * 3 / 2; > > } > > > > data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE); > > > LGTM. I presume you used a NAL unit of size 1? Yes, nal unit size 1 caused the problem. > > (I found this out, too, when I tried (and postponed) to add mp4 > writing support for H.264.) Thanks,
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index 88fa0029cd6..5f71d805848 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, max_size = 0; for (i = 0; i < frag->nb_units; i++) { // Start code + content with worst-case emulation prevention. - max_size += 3 + frag->units[i].data_size * 3 / 2; + max_size += 4 + frag->units[i].data_size * 3 / 2; } data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);