From patchwork Wed Feb 22 12:42:14 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Niedermayer X-Patchwork-Id: 2637 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.103.65.149 with SMTP id x21csp881134vsf; Wed, 22 Feb 2017 05:20:10 -0800 (PST) X-Received: by 10.28.20.144 with SMTP id 138mr2304007wmu.41.1487769610510; Wed, 22 Feb 2017 05:20:10 -0800 (PST) Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id y128si2596933wme.153.2017.02.22.05.20.09; Wed, 22 Feb 2017 05:20:10 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id EA0BF688303; Wed, 22 Feb 2017 15:19:57 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from vie01a-qmta-pe01-2.mx.upcmail.net (vie01a-qmta-pe01-2.mx.upcmail.net [62.179.121.179]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 770636882C4 for ; Wed, 22 Feb 2017 15:19:51 +0200 (EET) Received: from [172.31.218.32] (helo=vie01a-dmta-pe01-2.mx.upcmail.net) by vie01a-pqmta-pe01.mx.upcmail.net with esmtp (Exim 4.87) (envelope-from ) id 1cgWFZ-0003Ae-IC for ffmpeg-devel@ffmpeg.org; Wed, 22 Feb 2017 13:42:29 +0100 Received: from [172.31.216.43] (helo=vie01a-pemc-psmtp-pe01) by vie01a-dmta-pe01.mx.upcmail.net with esmtp (Exim 4.87) (envelope-from ) id 1cgWFR-00020u-BU for ffmpeg-devel@ffmpeg.org; Wed, 22 Feb 2017 13:42:21 +0100 Received: from localhost ([213.47.41.20]) by vie01a-pemc-psmtp-pe01 with SMTP @ mailcloud.upcmail.net id noiE1u0150S5wYM01oiFgL; Wed, 22 Feb 2017 13:42:17 +0100 X-SourceIP: 213.47.41.20 From: Michael Niedermayer To: FFmpeg development discussions and patches Date: Wed, 22 Feb 2017 13:42:14 +0100 Message-Id: <20170222124214.19183-1-michael@niedermayer.cc> X-Mailer: git-send-email 2.11.0 Subject: [FFmpeg-devel] [PATCH] avcodec/h264_ps: Check chroma_qp_index_offset X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Fixes: 647/clusterfuzz-testcase-5195745823031296 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg Signed-off-by: Michael Niedermayer --- libavcodec/h264_ps.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c index 8090178395..f4a4a01fbe 100644 --- a/libavcodec/h264_ps.c +++ b/libavcodec/h264_ps.c @@ -828,6 +828,12 @@ int ff_h264_decode_picture_parameter_set(GetBitContext *gb, AVCodecContext *avct pps->init_qp = get_se_golomb(gb) + 26 + qp_bd_offset; pps->init_qs = get_se_golomb(gb) + 26 + qp_bd_offset; pps->chroma_qp_index_offset[0] = get_se_golomb(gb); + if (pps->chroma_qp_index_offset[0] < -12 || pps->chroma_qp_index_offset[0] > 12) { + av_log(avctx, AV_LOG_ERROR, "chroma_qp_index_offset[0] %d is invalid\n", pps->chroma_qp_index_offset[0]); + ret = AVERROR_INVALIDDATA; + goto fail; + } + pps->deblocking_filter_parameters_present = get_bits1(gb); pps->constrained_intra_pred = get_bits1(gb); pps->redundant_pic_cnt_present = get_bits1(gb); @@ -845,6 +851,11 @@ int ff_h264_decode_picture_parameter_set(GetBitContext *gb, AVCodecContext *avct pps->scaling_matrix4, pps->scaling_matrix8); // second_chroma_qp_index_offset pps->chroma_qp_index_offset[1] = get_se_golomb(gb); + if (pps->chroma_qp_index_offset[1] < -12 || pps->chroma_qp_index_offset[1] > 12) { + av_log(avctx, AV_LOG_ERROR, "chroma_qp_index_offset[1] %d is invalid\n", pps->chroma_qp_index_offset[1]); + ret = AVERROR_INVALIDDATA; + goto fail; + } } else { pps->chroma_qp_index_offset[1] = pps->chroma_qp_index_offset[0]; }