diff mbox series

[FFmpeg-devel,17/17] avcodec/evc_ps: Check log2_sub_gop_length

Message ID 20230618234332.1370-7-jamrial@gmail.com
State Accepted
Commit 89f98acbf8dd84cfcd357cc67e8e8b8c25f98a38
Headers show
Series [FFmpeg-devel,1/3] avcodec/evc_frame_merge: use av_fast_realloc() | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 fail Make fate failed
andriy/make_x86 success Make finished
andriy/make_fate_x86 fail Make fate failed

Commit Message

James Almer June 18, 2023, 11:43 p.m. UTC 
From: Michael Niedermayer <michael@niedermayer.cc>

Fixes: 1.70141e+38 is outside the range of representable values of type 'int'
Fixes: 59883/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5557887217565696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavcodec/evc_ps.c | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
index b8d7329b94..0b8cc81d49 100644
--- a/libavcodec/evc_ps.c
+++ b/libavcodec/evc_ps.c
@@ -229,6 +229,10 @@  int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size)
 
     if (!sps->sps_pocs_flag || !sps->sps_rpl_flag) {
         sps->log2_sub_gop_length = get_ue_golomb(&gb);
+        if (sps->log2_sub_gop_length > 5U) {
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
         if (sps->log2_sub_gop_length == 0)
             sps->log2_ref_pic_gap_length = get_ue_golomb(&gb);
     }
@@ -288,6 +292,9 @@  int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size)
     ps->sps[sps_seq_parameter_set_id] = sps;
 
     return 0;
+fail:
+    av_free(sps);
+    return ret;
 }
 
 // @see ISO_IEC_23094-1 (7.3.2.2 SPS RBSP syntax)