har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/hevcdec: Check for overlapping slices

Browse Source 
Fixes: Timeout
Fixes: 10108/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6222384351674368

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-11-16 20:03:01 +01:00
parent 7f22a4ebc9
commit 1a89ae1df8
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/hevcdec.c
View File

@ -2942,6 +2942,7 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
s->max_ra = INT_MIN; s->max_ra = INT_MIN;
} }
s->overlap ++;
ret = hevc_frame_start(s); ret = hevc_frame_start(s);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -3020,6 +3021,7 @@ static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
s->ref = NULL; s->ref = NULL;
s->last_eos = s->eos; s->last_eos = s->eos;
s->eos = 0; s->eos = 0;
s->overlap = 0;
/* split the input packet into NAL units, so we know the upper bound on the /* split the input packet into NAL units, so we know the upper bound on the
* number of slices in the frame */ * number of slices in the frame */
@ -3054,6 +3056,8 @@ static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
continue; continue;
ret = decode_nal_unit(s, nal); ret = decode_nal_unit(s, nal);
if (ret >= 0 && s->overlap > 2)
ret = AVERROR_INVALIDDATA;
if (ret < 0) { if (ret < 0) {
av_log(s->avctx, AV_LOG_WARNING, av_log(s->avctx, AV_LOG_WARNING,
"Error parsing NAL unit #%d.\n", i); "Error parsing NAL unit #%d.\n", i);

1
libavcodec/hevcdec.h
View File

@ -430,6 +430,7 @@ typedef struct HEVCContext {
int max_ra; int max_ra;
int bs_width; int bs_width;
int bs_height; int bs_height;
int overlap;
int is_decoded; int is_decoded;
int no_rasl_output_flag; int no_rasl_output_flag;