Quoting Michael Niedermayer (2024-06-24 01:01:34) > The slice code detects changes by comparing the pps index. > That way the code cannot detect changes if the sets can change. > > Fixes: out of array access > Fixes: > 69585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6389604524556288 > Fixes: > 69601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5069068613255168 > Fixes: > 69621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6187334182174720 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/hevc/hevcdec.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c > index 1d2e53afc32..d68d454537a 100644 > --- a/libavcodec/hevc/hevcdec.c > +++ b/libavcodec/hevc/hevcdec.c > @@ -3221,17 +3221,20 @@ static int decode_nal_unit(HEVCContext *s, const > H2645NAL *nal) > ret = ff_hevc_decode_nal_vps(&gb, s->avctx, &s->ps); > if (ret < 0) > goto fail; > + s->sh.pps_id = -1;
This is backwards. If the problem is that the current check does not detect the change, then the check should be fixed. -- Anton Khirnov _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
