| Message ID | 20240816231504.3166080-3-michael@niedermayer.cc |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel,1/5] avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/commit_msg_loongarch64 | warning | The first line of the commit message must start with a context terminated by a colon and a space, for example "lavu/opt: " or "doc: ". |
On 8/16/2024 8:15 PM, Michael Niedermayer wrote: > Fixes: Assertion width > 0 && width <= 32 failed > Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/cbs_h265_syntax_template.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c > index 12fa185c774..d23cb58e863 100644 > --- a/libavcodec/cbs_h265_syntax_template.c > +++ b/libavcodec/cbs_h265_syntax_template.c > @@ -2307,6 +2307,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext > else > length = FFMAX(0, (int)current->exponent_ref_display_width[i] + > (int)current->prec_ref_display_width - 31); > + > + if (length > 32) > + return AVERROR_PATCHWELCOME; I guess this error code is fine since CBS currently can't read values > 32 and this element can be up to 62 bits long. Maybe also print an error that says something like "refDispWidthBits > 32 is not supported". > + > if (length) > ubs(length, mantissa_ref_display_width[i], 1, i); > else > @@ -2318,6 +2322,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext > else > length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + > (int)current->prec_ref_viewing_dist - 31); > + > + if (length > 32) > + return AVERROR_PATCHWELCOME; Ditto, "refViewDistBits > 32 is not supported". > + > if (length) > ubs(length, mantissa_ref_viewing_distance[i], 1, i); > else
On Fri, Aug 16, 2024 at 08:38:41PM -0300, James Almer wrote: > On 8/16/2024 8:15 PM, Michael Niedermayer wrote: > > Fixes: Assertion width > 0 && width <= 32 failed > > Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808 > > > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/cbs_h265_syntax_template.c | 8 ++++++++ > > 1 file changed, 8 insertions(+) > > > > diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c > > index 12fa185c774..d23cb58e863 100644 > > --- a/libavcodec/cbs_h265_syntax_template.c > > +++ b/libavcodec/cbs_h265_syntax_template.c > > @@ -2307,6 +2307,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext > > else > > length = FFMAX(0, (int)current->exponent_ref_display_width[i] + > > (int)current->prec_ref_display_width - 31); > > + > > + if (length > 32) > > + return AVERROR_PATCHWELCOME; > > I guess this error code is fine since CBS currently can't read values > 32 > and this element can be up to 62 bits long. > > Maybe also print an error that says something like "refDispWidthBits > 32 is > not supported". > > > + > > if (length) > > ubs(length, mantissa_ref_display_width[i], 1, i); > > else > > @@ -2318,6 +2322,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext > > else > > length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + > > (int)current->prec_ref_viewing_dist - 31); > > + > > + if (length > 32) > > + return AVERROR_PATCHWELCOME; > > Ditto, "refViewDistBits > 32 is not supported". will apply with these changes thx [...]
diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c index 12fa185c774..d23cb58e863 100644 --- a/libavcodec/cbs_h265_syntax_template.c +++ b/libavcodec/cbs_h265_syntax_template.c @@ -2307,6 +2307,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_display_width[i] + (int)current->prec_ref_display_width - 31); + + if (length > 32) + return AVERROR_PATCHWELCOME; + if (length) ubs(length, mantissa_ref_display_width[i], 1, i); else @@ -2318,6 +2322,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext else length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] + (int)current->prec_ref_viewing_dist - 31); + + if (length > 32) + return AVERROR_PATCHWELCOME; + if (length) ubs(length, mantissa_ref_viewing_distance[i], 1, i); else
Fixes: Assertion width > 0 && width <= 32 failed Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/cbs_h265_syntax_template.c | 8 ++++++++ 1 file changed, 8 insertions(+)