The slice code detects changes by comparing the pps index. That way the code cannot detect changes if the sets can change.
Fixes: out of array access Fixes: 69585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6389604524556288 Fixes: 69601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5069068613255168 Fixes: 69621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6187334182174720 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/hevc/hevcdec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index 1d2e53afc32..d68d454537a 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -3221,17 +3221,20 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal) ret = ff_hevc_decode_nal_vps(&gb, s->avctx, &s->ps); if (ret < 0) goto fail; + s->sh.pps_id = -1; break; case HEVC_NAL_SPS: ret = ff_hevc_decode_nal_sps(&gb, s->avctx, &s->ps, s->apply_defdispwin); if (ret < 0) goto fail; + s->sh.pps_id = -1; break; case HEVC_NAL_PPS: ret = ff_hevc_decode_nal_pps(&gb, s->avctx, &s->ps); if (ret < 0) goto fail; + s->sh.pps_id = -1; break; case HEVC_NAL_SEI_PREFIX: case HEVC_NAL_SEI_SUFFIX: -- 2.45.2 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
