On Mon, Aug 05, 2019 at 12:19:24PM -0300, James Almer wrote: > On 8/4/2019 1:44 PM, Michael Niedermayer wrote: > > Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]' > > Fixes: > > 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > > --- > > libavcodec/cbs_av1_syntax_template.c | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > > > > diff --git a/libavcodec/cbs_av1_syntax_template.c > > b/libavcodec/cbs_av1_syntax_template.c > > index b04cd51d55..806b302de6 100644 > > --- a/libavcodec/cbs_av1_syntax_template.c > > +++ b/libavcodec/cbs_av1_syntax_template.c > > @@ -419,16 +419,17 @@ static int > > FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw, > > for (i = 0; i < AV1_REFS_PER_FRAME; i++) { > > flags(found_ref[i], 1, i); > > if (current->found_ref[i]) { > > - AV1ReferenceFrameState *ref = > > - &priv->ref[current->ref_frame_idx[i]]; > > + AV1ReferenceFrameState *ref; > > > > - if (!ref->valid) { > > + if (current->ref_frame_idx[i] < 0 || > > + !priv->ref[current->ref_frame_idx[i]].valid) { > > av_log(ctx->log_ctx, AV_LOG_ERROR, > > "Missing reference frame needed for frame size " > > "(ref = %d, ref_frame_idx = %d).\n", > > i, current->ref_frame_idx[i]); > > return AVERROR_INVALIDDATA; > > } > > + ref = &priv->ref[current->ref_frame_idx[i]]; > > > > priv->upscaled_width = ref->upscaled_width; > > priv->frame_width = ref->frame_width; > > This actually revealed a bug when setting ref_frame_idx[i] in the > frame_refs_short_signaling == true code path. It's incomplete given that > the -1 is a placeholder meant to be replaced further into the process. > > This change is ok to prevent the out of bounds issue for now, but valid > files are in theory being rejected, and that should be fixed.
ok, will apply then. Thanks [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Into a blind darkness they enter who follow after the Ignorance, they as if into a greater darkness enter who devote themselves to the Knowledge alone. -- Isha Upanishad
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
