Fixes: fuzzer timeout Fixes: 65253/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_MP4TOANNEXB_fuzzer-4972412487467008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/bsf/vvc_mp4toannexb.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavcodec/bsf/vvc_mp4toannexb.c b/libavcodec/bsf/vvc_mp4toannexb.c index 25c3726918..a15c1eef5b 100644 --- a/libavcodec/bsf/vvc_mp4toannexb.c +++ b/libavcodec/bsf/vvc_mp4toannexb.c @@ -168,8 +168,10 @@ static int vvc_extradata_to_annexb(AVBSFContext *ctx) goto fail; AV_WB32(new_extradata + new_extradata_size, 1); // add the startcode - bytestream2_get_buffer(&gb, new_extradata + new_extradata_size + 4, - nalu_len); + if (bytestream2_get_buffer(&gb, new_extradata + new_extradata_size + 4, nalu_len) != nalu_len) { + ret = AVERROR_INVALIDDATA; + goto fail; + } new_extradata_size += 4 + nalu_len; memset(new_extradata + new_extradata_size, 0, AV_INPUT_BUFFER_PADDING_SIZE); @@ -298,8 +300,10 @@ static int vvc_mp4toannexb_filter(AVBSFContext *ctx, AVPacket *out) if (extra_size) memcpy(out->data + prev_size, ctx->par_out->extradata, extra_size); AV_WB32(out->data + prev_size + extra_size, 1); - bytestream2_get_buffer(&gb, out->data + prev_size + 4 + extra_size, - nalu_size); + if (bytestream2_get_buffer(&gb, out->data + prev_size + 4 + extra_size, nalu_size) != nalu_size) { + ret = AVERROR_INVALIDDATA; + goto fail; + } } ret = av_packet_copy_props(out, in); -- 2.25.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
