ffmpeg | branch: release/4.2 | Andriy Gelman <andriy.gel...@gmail.com> | Fri Dec 6 11:03:02 2019 -0500| [0493699813ccff57f9ac317afdc1c8be97cc64f5] | committer: James Almer
lavc/cbs_h2645: Fix incorrect max size of nalu unit In the worst case the startcode prefix has 4 bytes. This fixes a trigerred assertion: Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 Found-by:libFuzzer Reviewed-by: Andreas Rheinhardt <andreas.rheinha...@gmail.com> Signed-off-by: Andriy Gelman <andriy.gel...@gmail.com> (cherry picked from commit 02a83e26de6a58523ee55cfebc1312e7a4e42724) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0493699813ccff57f9ac317afdc1c8be97cc64f5 --- libavcodec/cbs_h2645.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c index c95f1308e9..c3cb88d9c6 100644 --- a/libavcodec/cbs_h2645.c +++ b/libavcodec/cbs_h2645.c @@ -1454,7 +1454,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx, max_size = 0; for (i = 0; i < frag->nb_units; i++) { // Start code + content with worst-case emulation prevention. - max_size += 3 + frag->units[i].data_size * 3 / 2; + max_size += 4 + frag->units[i].data_size * 3 / 2; } data = av_malloc(max_size + AV_INPUT_BUFFER_PADDING_SIZE); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
