| Message ID | 20191213221758.27986-1-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
On 12/13/2019 7:17 PM, Michael Niedermayer wrote: > Fixes: assertion failure > Fixes: 19286/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5707990724509696 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/cbs_h2645.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c > index 5f71d80584..90f77d0039 100644 > --- a/libavcodec/cbs_h2645.c > +++ b/libavcodec/cbs_h2645.c > @@ -568,7 +568,10 @@ static int cbs_h2645_fragment_add_nals(CodedBitstreamContext *ctx, > // Remove trailing zeroes. > while (size > 0 && nal->data[size - 1] == 0) > --size; > - av_assert0(size > 0); > + if (size == 0) { > + av_log(ctx->log_ctx, AV_LOG_WARNING, "Discarding empty 0 NAL unit\n"); IMO, no warning message, same as h2645_parse. Or if anything, make it VERBOSE. LGTM otherwise. > + continue; > + } > > ref = (nal->data == nal->raw_data) ? frag->data_ref > : packet->rbsp.rbsp_buffer_ref; >
On Fri, Dec 13, 2019 at 07:26:04PM -0300, James Almer wrote: > On 12/13/2019 7:17 PM, Michael Niedermayer wrote: > > Fixes: assertion failure > > Fixes: 19286/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5707990724509696 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/cbs_h2645.c | 5 ++++- > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c > > index 5f71d80584..90f77d0039 100644 > > --- a/libavcodec/cbs_h2645.c > > +++ b/libavcodec/cbs_h2645.c > > @@ -568,7 +568,10 @@ static int cbs_h2645_fragment_add_nals(CodedBitstreamContext *ctx, > > // Remove trailing zeroes. > > while (size > 0 && nal->data[size - 1] == 0) > > --size; > > - av_assert0(size > 0); > > + if (size == 0) { > > + av_log(ctx->log_ctx, AV_LOG_WARNING, "Discarding empty 0 NAL unit\n"); > > IMO, no warning message, same as h2645_parse. Or if anything, make it > VERBOSE. > > LGTM otherwise. will apply with VERBOSE thx [...]
diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index 5f71d80584..90f77d0039 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -568,7 +568,10 @@ static int cbs_h2645_fragment_add_nals(CodedBitstreamContext *ctx, // Remove trailing zeroes. while (size > 0 && nal->data[size - 1] == 0) --size; - av_assert0(size > 0); + if (size == 0) { + av_log(ctx->log_ctx, AV_LOG_WARNING, "Discarding empty 0 NAL unit\n"); + continue; + } ref = (nal->data == nal->raw_data) ? frag->data_ref : packet->rbsp.rbsp_buffer_ref;
Fixes: assertion failure Fixes: 19286/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-5707990724509696 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/cbs_h2645.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)