On Fri, 06. Dec 17:47, Andreas Rheinhardt wrote:
> Andriy Gelman:
> > From: Andriy Gelman <andriy.gel...@gmail.com>
> >
> > In the worst case the startcode prefix has 4 bytes.
> >
> > This fixes a trigerred assertion:
> > Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451
> >
> > Found-by:libFuzzer
> > Signed-off-by: Andriy Gelman <andriy.gel...@gmail.com>
> > ---
> > libavcodec/cbs_h2645.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
> > index 88fa0029cd6..5f71d805848 100644
> > --- a/libavcodec/cbs_h2645.c
> > +++ b/libavcodec/cbs_h2645.c
> > @@ -1395,7 +1395,7 @@ static int
> > cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
> > max_size = 0;
> > for (i = 0; i < frag->nb_units; i++) {
> > // Start code + content with worst-case emulation prevention.
> > - max_size += 3 + frag->units[i].data_size * 3 / 2;
> > + max_size += 4 + frag->units[i].data_size * 3 / 2;
> > }
> >
> > data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
> >
> LGTM. I presume you used a NAL unit of size 1?
Yes, nal unit size 1 caused the problem.
>
> (I found this out, too, when I tried (and postponed) to add mp4
> writing support for H.264.)
Thanks,
--
Andriy
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
