| Message ID | AS8P250MB074445AB300959EFCE0F78D58FD42@AS8P250MB0744.EURP250.PROD.OUTLOOK.COM |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/mpeg12dec: Don't adapt (last|next)_pic.linesize for field pics | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
On Mon, Jun 24, 2024 at 02:01:42AM +0200, Andreas Rheinhardt wrote: > These values are not read anywhere. Furthermore, since commit > fe6037fd04db8837dcdb9013f9c4ad4e7eb0592e the linesize values > of the MPVWorkPictures were wrong for subsequent fields > in a chain of B-pictures (as they are always doubled and no longer > based upon the frame-linesizes) which can eventually lead to overflow. > > Finally, it makes no real sense to ever double the linesize > of the reference pictures at all: Even when the current picture > is a field, it can still reference both fields of reference > pictures and therefore the linesize should allow to address > both fields (for the same reason, data is not offset for > reference pictures). > > libavcodec/mpeg12dec.c:1304:41: runtime error: signed integer overflow: 4611686018427387904 * 2 cannot be represented in type 'long' > > issue: 69732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5123551179374592 > > Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> > --- > libavcodec/mpeg12dec.c | 2 -- > 1 file changed, 2 deletions(-) Tested, fixes the issue thx [...]
diff --git a/libavcodec/mpeg12dec.c b/libavcodec/mpeg12dec.c index 7485b7c65f..6953ba828d 100644 --- a/libavcodec/mpeg12dec.c +++ b/libavcodec/mpeg12dec.c @@ -1278,8 +1278,6 @@ static int mpeg_field_start(Mpeg1Context *s1, const uint8_t *buf, int buf_size) s->cur_pic.linesize[i]); } s->cur_pic.linesize[i] *= 2; - s->last_pic.linesize[i] *= 2; - s->next_pic.linesize[i] *= 2; } }
These values are not read anywhere. Furthermore, since commit fe6037fd04db8837dcdb9013f9c4ad4e7eb0592e the linesize values of the MPVWorkPictures were wrong for subsequent fields in a chain of B-pictures (as they are always doubled and no longer based upon the frame-linesizes) which can eventually lead to overflow. Finally, it makes no real sense to ever double the linesize of the reference pictures at all: Even when the current picture is a field, it can still reference both fields of reference pictures and therefore the linesize should allow to address both fields (for the same reason, data is not offset for reference pictures). libavcodec/mpeg12dec.c:1304:41: runtime error: signed integer overflow: 4611686018427387904 * 2 cannot be represented in type 'long' issue: 69732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5123551179374592 Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com> --- libavcodec/mpeg12dec.c | 2 -- 1 file changed, 2 deletions(-)