[FFmpeg-devel,1/3] avcodec/hevcdec: Check for overlapping slices

Submitted by Michael Niedermayer on Nov. 17, 2018, 2:01 a.m.

Details

Message ID 20181117020145.17164-1-michael@niedermayer.cc
State Accepted
Headers show

Commit Message

Michael Niedermayer Nov. 17, 2018, 2:01 a.m.
Fixes: Timeout
Fixes: 10108/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6222384351674368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevcdec.c | 8 ++++++++
 libavcodec/hevcdec.h | 1 +
 2 files changed, 9 insertions(+)

Comments

Michael Niedermayer Nov. 24, 2018, 1:41 a.m.
On Sat, Nov 17, 2018 at 03:01:43AM +0100, Michael Niedermayer wrote:
> Fixes: Timeout
> Fixes: 10108/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6222384351674368
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hevcdec.c | 8 ++++++++
>  libavcodec/hevcdec.h | 1 +
>  2 files changed, 9 insertions(+)

will post a simpler solution


[...]

Patch hide | download patch | download mbox

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index a3b5c8cb71..facabb0e79 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -2405,6 +2405,10 @@  static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread)
 
         x_ctb = (ctb_addr_rs % ((s->ps.sps->width + ctb_size - 1) >> s->ps.sps->log2_ctb_size)) << s->ps.sps->log2_ctb_size;
         y_ctb = (ctb_addr_rs / ((s->ps.sps->width + ctb_size - 1) >> s->ps.sps->log2_ctb_size)) << s->ps.sps->log2_ctb_size;
+
+
+        if (s->tab_slice_address[ctb_addr_rs] >= 0)
+            s->overlap ++;
         hls_decode_neighbour(s, x_ctb, y_ctb, ctb_addr_ts);
 
         ret = ff_hevc_cabac_init(s, ctb_addr_ts);
@@ -2427,6 +2431,7 @@  static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread)
 
 
         ctb_addr_ts++;
+        s->overlap++;
         ff_hevc_save_states(s, ctb_addr_ts);
         ff_hevc_hls_filters(s, x_ctb, y_ctb, ctb_size);
     }
@@ -3020,6 +3025,7 @@  static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
     s->ref = NULL;
     s->last_eos = s->eos;
     s->eos = 0;
+    s->overlap = 0;
 
     /* split the input packet into NAL units, so we know the upper bound on the
      * number of slices in the frame */
@@ -3054,6 +3060,8 @@  static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
             continue;
 
         ret = decode_nal_unit(s, nal);
+        if (s->ps.sps && ret >= 0 && s->overlap > 2*s->ps.sps->ctb_size)
+            ret = AVERROR_INVALIDDATA;
         if (ret < 0) {
             av_log(s->avctx, AV_LOG_WARNING,
                    "Error parsing NAL unit #%d.\n", i);
diff --git a/libavcodec/hevcdec.h b/libavcodec/hevcdec.h
index dd951aae06..b45969b7e2 100644
--- a/libavcodec/hevcdec.h
+++ b/libavcodec/hevcdec.h
@@ -430,6 +430,7 @@  typedef struct HEVCContext {
     int max_ra;
     int bs_width;
     int bs_height;
+    int overlap;
 
     int is_decoded;
     int no_rasl_output_flag;