| Message ID | 20221105201629.1980-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 024c5b4ab436b9e035517e4181dc3499e7095290 |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/dts2pts_bsf: Check ctx for NULL before ff_cbs_flush() | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On 11/5/2022 5:16 PM, Michael Niedermayer wrote: > Fixes: null pointer dereference > Fixes: 52155/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5760107527143424 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/dts2pts_bsf.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/dts2pts_bsf.c b/libavcodec/dts2pts_bsf.c > index bf20b1ec8a..8142562d2c 100644 > --- a/libavcodec/dts2pts_bsf.c > +++ b/libavcodec/dts2pts_bsf.c > @@ -505,7 +505,8 @@ static void dts2pts_flush(AVBSFContext *ctx) > s->root = NULL; > > ff_cbs_fragment_reset(&s->au); > - ff_cbs_flush(s->cbc); > + if (s->cbc) > + ff_cbs_flush(s->cbc); > } > > static void dts2pts_close(AVBSFContext *ctx) Should be ok.
On Sun, Nov 06, 2022 at 07:38:42PM -0300, James Almer wrote: > On 11/5/2022 5:16 PM, Michael Niedermayer wrote: > > Fixes: null pointer dereference > > Fixes: 52155/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5760107527143424 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/dts2pts_bsf.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/libavcodec/dts2pts_bsf.c b/libavcodec/dts2pts_bsf.c > > index bf20b1ec8a..8142562d2c 100644 > > --- a/libavcodec/dts2pts_bsf.c > > +++ b/libavcodec/dts2pts_bsf.c > > @@ -505,7 +505,8 @@ static void dts2pts_flush(AVBSFContext *ctx) > > s->root = NULL; > > ff_cbs_fragment_reset(&s->au); > > - ff_cbs_flush(s->cbc); > > + if (s->cbc) > > + ff_cbs_flush(s->cbc); > > } > > static void dts2pts_close(AVBSFContext *ctx) > > Should be ok. will apply thx [...]
diff --git a/libavcodec/dts2pts_bsf.c b/libavcodec/dts2pts_bsf.c index bf20b1ec8a..8142562d2c 100644 --- a/libavcodec/dts2pts_bsf.c +++ b/libavcodec/dts2pts_bsf.c @@ -505,7 +505,8 @@ static void dts2pts_flush(AVBSFContext *ctx) s->root = NULL; ff_cbs_fragment_reset(&s->au); - ff_cbs_flush(s->cbc); + if (s->cbc) + ff_cbs_flush(s->cbc); } static void dts2pts_close(AVBSFContext *ctx)
Fixes: null pointer dereference Fixes: 52155/clusterfuzz-testcase-minimized-ffmpeg_BSF_DTS2PTS_fuzzer-5760107527143424 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/dts2pts_bsf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)