| Message ID | 20230602153035.1877-1-jamrial@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/cbs: reset the fragment on reading failure | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On 6/2/2023 12:30 PM, James Almer wrote: > Fixes: NULL pointer dereference > Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: James Almer <jamrial@gmail.com> > --- > libavcodec/cbs.c | 18 +++++++++++++----- > 1 file changed, 13 insertions(+), 5 deletions(-) Superseded by commit 8c6b931f4c, so patch withdrawn.
diff --git a/libavcodec/cbs.c b/libavcodec/cbs.c index 504197e06d..ba134c1db2 100644 --- a/libavcodec/cbs.c +++ b/libavcodec/cbs.c @@ -249,8 +249,10 @@ static int cbs_read_data(CodedBitstreamContext *ctx, if (buf) { frag->data_ref = av_buffer_ref(buf); - if (!frag->data_ref) - return AVERROR(ENOMEM); + if (!frag->data_ref) { + err = AVERROR(ENOMEM); + goto end; + } frag->data = (uint8_t *)data; frag->data_size = size; @@ -258,14 +260,20 @@ static int cbs_read_data(CodedBitstreamContext *ctx, } else { err = cbs_fill_fragment_data(frag, data, size); if (err < 0) - return err; + goto end; } err = ctx->codec->split_fragment(ctx, frag, header); if (err < 0) - return err; + goto end; - return cbs_read_fragment_content(ctx, frag); + err = cbs_read_fragment_content(ctx, frag); + +end: + if (err < 0) + ff_cbs_fragment_reset(frag); + + return err; } int ff_cbs_read_extradata(CodedBitstreamContext *ctx,
Fixes: NULL pointer dereference Fixes: 59359/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AV1_fuzzer-6726080594313216 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: James Almer <jamrial@gmail.com> --- libavcodec/cbs.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)