diff mbox series

[FFmpeg-devel,1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error

Message ID 20230915131147.5945-1-michael@niedermayer.cc
State Accepted
Commit 120f74650d924f37285c73c6a78c8fc775b00c09
Headers show
Series [FFmpeg-devel,1/4] avcodec/evc_ps: Check cpb_cnt_minus1 and propagate error | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Sept. 15, 2023, 1:11 p.m. UTC 
Fixes: out of array access
Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/evc_ps.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

Comments

Michael Niedermayer Sept. 22, 2023, 6:48 p.m. UTC | #1 
On Fri, Sep 15, 2023 at 03:11:44PM +0200, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: 60949/clusterfuzz-testcase-minimized-ffmpeg_dem_EVC_fuzzer-5959738853294080
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/evc_ps.c | 27 +++++++++++++++++++++------
>  1 file changed, 21 insertions(+), 6 deletions(-)

will apply

[...]
diff mbox series

Patch

diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
index 64384a392c2..7fe13fd32f0 100644
--- a/libavcodec/evc_ps.c
+++ b/libavcodec/evc_ps.c
@@ -53,6 +53,9 @@  static int ref_pic_list_struct(GetBitContext *gb, RefPicListStruct *rpl)
 static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
 {
     hrd->cpb_cnt_minus1 = get_ue_golomb_31(gb);
+    if (hrd->cpb_cnt_minus1 >= FF_ARRAY_ELEMS(hrd->cpb_size_value_minus1))
+        return AVERROR_INVALIDDATA;
+
     hrd->bit_rate_scale = get_bits(gb, 4);
     hrd->cpb_size_scale = get_bits(gb, 4);
     for (int SchedSelIdx = 0; SchedSelIdx <= hrd->cpb_cnt_minus1; SchedSelIdx++) {
@@ -71,6 +74,8 @@  static int hrd_parameters(GetBitContext *gb, HRDParameters *hrd)
 // @see  ISO_IEC_23094-1 (E.2.1 VUI parameters syntax)
 static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
 {
+    int ret;
+
     vui->aspect_ratio_info_present_flag = get_bits(gb, 1);
     if (vui->aspect_ratio_info_present_flag) {
         vui->aspect_ratio_idc = get_bits(gb, 8);
@@ -109,11 +114,18 @@  static int vui_parameters(GetBitContext *gb, VUIParameters *vui)
         vui->fixed_pic_rate_flag = get_bits(gb, 1);
     }
     vui->nal_hrd_parameters_present_flag = get_bits(gb, 1);
-    if (vui->nal_hrd_parameters_present_flag)
-        hrd_parameters(gb, &vui->hrd_parameters);
+    if (vui->nal_hrd_parameters_present_flag) {
+        ret = hrd_parameters(gb, &vui->hrd_parameters);
+        if (ret < 0)
+            return ret;
+    }
+
     vui->vcl_hrd_parameters_present_flag = get_bits(gb, 1);
-    if (vui->vcl_hrd_parameters_present_flag)
-        hrd_parameters(gb, &vui->hrd_parameters);
+    if (vui->vcl_hrd_parameters_present_flag) {
+        ret = hrd_parameters(gb, &vui->hrd_parameters);
+        if (ret < 0)
+            return ret;
+    }
     if (vui->nal_hrd_parameters_present_flag || vui->vcl_hrd_parameters_present_flag)
         vui->low_delay_hrd_flag = get_bits(gb, 1);
     vui->pic_struct_present_flag = get_bits(gb, 1);
@@ -292,8 +304,11 @@  int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets *ps)
     }
 
     sps->vui_parameters_present_flag = get_bits1(gb);
-    if (sps->vui_parameters_present_flag)
-        vui_parameters(gb, &(sps->vui_parameters));
+    if (sps->vui_parameters_present_flag) {
+        ret = vui_parameters(gb, &(sps->vui_parameters));
+        if (ret < 0)
+            goto fail;
+    }
 
     // @note
     // If necessary, add the missing fields to the EVCParserSPS structure