Nuo Mi: > Fixes: fuzzer timeout > Fixes: > 65253/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_MP4TOANNEXB_fuzzer-4972412487467008 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/bsf/vvc_mp4toannexb.c | 12 ++++++++---- > 1 file changed, 8 insertions(+), 4 deletions(-) > > diff --git a/libavcodec/bsf/vvc_mp4toannexb.c > b/libavcodec/bsf/vvc_mp4toannexb.c > index 25c3726918..a15c1eef5b 100644 > --- a/libavcodec/bsf/vvc_mp4toannexb.c > +++ b/libavcodec/bsf/vvc_mp4toannexb.c > @@ -168,8 +168,10 @@ static int vvc_extradata_to_annexb(AVBSFContext *ctx) > goto fail; > > AV_WB32(new_extradata + new_extradata_size, 1); // add the > startcode > - bytestream2_get_buffer(&gb, new_extradata + new_extradata_size + > 4, > - nalu_len); > + if (bytestream2_get_buffer(&gb, new_extradata + > new_extradata_size + 4, nalu_len) != nalu_len) { > + ret = AVERROR_INVALIDDATA; > + goto fail; > + } > new_extradata_size += 4 + nalu_len; > memset(new_extradata + new_extradata_size, 0, > AV_INPUT_BUFFER_PADDING_SIZE); > @@ -298,8 +300,10 @@ static int vvc_mp4toannexb_filter(AVBSFContext *ctx, > AVPacket *out) > if (extra_size) > memcpy(out->data + prev_size, ctx->par_out->extradata, > extra_size); > AV_WB32(out->data + prev_size + extra_size, 1); > - bytestream2_get_buffer(&gb, out->data + prev_size + 4 + extra_size, > - nalu_size); > + if (bytestream2_get_buffer(&gb, out->data + prev_size + 4 + > extra_size, nalu_size) != nalu_size) { > + ret = AVERROR_INVALIDDATA; > + goto fail; > + } > } > > ret = av_packet_copy_props(out, in);
It is better to check that there is enough input before growing the packet/the extradata. This also allows to use unchecked reads lateron. - Andreas _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
