On Thu, Feb 8, 2024 at 11:50 PM Andreas Rheinhardt < andreas.rheinha...@outlook.com> wrote:
> Nuo Mi: > > Fixes: fuzzer timeout > > Fixes: > 65253/clusterfuzz-testcase-minimized-ffmpeg_BSF_VVC_MP4TOANNEXB_fuzzer-4972412487467008 > > > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/bsf/vvc_mp4toannexb.c | 12 ++++++++---- > > 1 file changed, 8 insertions(+), 4 deletions(-) > > > > diff --git a/libavcodec/bsf/vvc_mp4toannexb.c > b/libavcodec/bsf/vvc_mp4toannexb.c > > index 25c3726918..a15c1eef5b 100644 > > --- a/libavcodec/bsf/vvc_mp4toannexb.c > > +++ b/libavcodec/bsf/vvc_mp4toannexb.c > > @@ -168,8 +168,10 @@ static int vvc_extradata_to_annexb(AVBSFContext > *ctx) > > goto fail; > > > > AV_WB32(new_extradata + new_extradata_size, 1); // add the > startcode > > - bytestream2_get_buffer(&gb, new_extradata + > new_extradata_size + 4, > > - nalu_len); > > + if (bytestream2_get_buffer(&gb, new_extradata + > new_extradata_size + 4, nalu_len) != nalu_len) { > > + ret = AVERROR_INVALIDDATA; > > + goto fail; > > + } > > new_extradata_size += 4 + nalu_len; > > memset(new_extradata + new_extradata_size, 0, > > AV_INPUT_BUFFER_PADDING_SIZE); > > @@ -298,8 +300,10 @@ static int vvc_mp4toannexb_filter(AVBSFContext > *ctx, AVPacket *out) > > if (extra_size) > > memcpy(out->data + prev_size, ctx->par_out->extradata, > extra_size); > > AV_WB32(out->data + prev_size + extra_size, 1); > > - bytestream2_get_buffer(&gb, out->data + prev_size + 4 + > extra_size, > > - nalu_size); > > + if (bytestream2_get_buffer(&gb, out->data + prev_size + 4 + > extra_size, nalu_size) != nalu_size) { > > + ret = AVERROR_INVALIDDATA; > > + goto fail; > > + } > > } > > > > ret = av_packet_copy_props(out, in); > > It is better to check that there is enough input before growing the > packet/the extradata. This also allows to use unchecked reads lateron. > Good idea, fixed in v2. > > - Andreas > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe". > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
