diff mbox series

[FFmpeg-devel] lavc: fix h264 parser bug

Message ID tencent_1A5A746EF0F810A9AFC4A3D70231D4069009@qq.com
State New
Headers show
Series [FFmpeg-devel] lavc: fix h264 parser bug | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 fail Make fate failed
andriy/make_x86 success Make finished
andriy/make_fate_x86 fail Make fate failed

Commit Message

Lingjiang Fang May 12, 2022, 4:22 p.m. UTC
will give a wrong nalu length(+1) when next nalu start with 00000001
this bug will lead to an padding zero to pps in AVC Sequence header(flv) or in avc1(mpr)

---

 libavcodec/h2645_parse.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Lingjiang Fang May 16, 2022, 10:37 a.m. UTC | #1
On Fri, 13 May 2022 00:22:02 +0800
Lingjiang Fang <vacingfang@foxmail.com> wrote:

ping for review
padding zero after pps may lead to decode crash in same ipads
btw, I am working on update fate cases to fit this bugfix

> will give a wrong nalu length(+1) when next nalu start with 00000001
> this bug will lead to an padding zero to pps in AVC Sequence
> header(flv) or in avc1(mpr)
> 
> ---
> 
>  libavcodec/h2645_parse.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
> index 03780680c6..2e941a2bd0 100644
> --- a/libavcodec/h2645_parse.c
> +++ b/libavcodec/h2645_parse.c
> @@ -134,6 +134,10 @@ int ff_h2645_extract_rbsp(const uint8_t *src,
> int length, dst[di++] = src[si++];
>  
>  nsc:
> +    if (src[si-1] == 0) {
> +        --di;
> +        --si;
> +    }
>      memset(dst + di, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>  
>      nal->data = dst;



Regards,
Lingjiang Fang
diff mbox series

Patch

diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
index 03780680c6..2e941a2bd0 100644
--- a/libavcodec/h2645_parse.c
+++ b/libavcodec/h2645_parse.c
@@ -134,6 +134,10 @@  int ff_h2645_extract_rbsp(const uint8_t *src, int length,
         dst[di++] = src[si++];
 
 nsc:
+    if (src[si-1] == 0) {
+        --di;
+        --si;
+    }
     memset(dst + di, 0, AV_INPUT_BUFFER_PADDING_SIZE);
 
     nal->data = dst;