diff mbox series

[FFmpeg-devel,4/5] avcodec/hevc/hevcdec: Check refPicList

Message ID 20240816231504.3166080-4-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/5] avcodec/get_buffer: Use av_buffer_mallocz() for audio same as its done for video | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished

Commit Message

Michael Niedermayer Aug. 16, 2024, 11:15 p.m. UTC 
This is likely not the proper way to fix this

Fixes: null pointer dereference
Fixes: 70781/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5010401476018176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/hevc/hevcdec.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Anton Khirnov Aug. 19, 2024, 7:28 p.m. UTC | #1 
Quoting Michael Niedermayer (2024-08-17 01:15:03)
> This is likely not the proper way to fix this

I agree.
Can you share the sample?
diff mbox series

Patch

diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
index 193d624fc98..dc8497bff12 100644
--- a/libavcodec/hevc/hevcdec.c
+++ b/libavcodec/hevc/hevcdec.c
@@ -1933,12 +1933,16 @@  static void hls_prediction_unit(HEVCLocalContext *lc,
             tab_mvf[(y_pu + j) * min_pu_width + x_pu + i] = current_mv;
 
     if (current_mv.pred_flag & PF_L0) {
+        if (!refPicList)
+            return;
         ref0 = refPicList[0].ref[current_mv.ref_idx[0]];
         if (!ref0 || !ref0->f)
             return;
         hevc_await_progress(s, ref0, &current_mv.mv[0], y0, nPbH);
     }
     if (current_mv.pred_flag & PF_L1) {
+        if (!refPicList)
+            return;
         ref1 = refPicList[1].ref[current_mv.ref_idx[1]];
         if (!ref1 || !ref1->f)
             return;