[FFmpeg-cvslog] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Michael Niedermayer
git at videolan.org
Mon Aug 5 19:02:41 EEST 2019
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Aug 4 09:51:26 2019 +0200| [8174e5c77d8a94b57b6b1bcbb90728cf8b08ab6b] | committer: Michael Niedermayer
avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]'
Fixes: 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial at gmail.com>
See: [FFmpeg-devel] [PATCH 05/13] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8174e5c77d8a94b57b6b1bcbb90728cf8b08ab6b
---
libavcodec/cbs_av1_syntax_template.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/libavcodec/cbs_av1_syntax_template.c b/libavcodec/cbs_av1_syntax_template.c
index b04cd51d55..806b302de6 100644
--- a/libavcodec/cbs_av1_syntax_template.c
+++ b/libavcodec/cbs_av1_syntax_template.c
@@ -419,16 +419,17 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
flags(found_ref[i], 1, i);
if (current->found_ref[i]) {
- AV1ReferenceFrameState *ref =
- &priv->ref[current->ref_frame_idx[i]];
+ AV1ReferenceFrameState *ref;
- if (!ref->valid) {
+ if (current->ref_frame_idx[i] < 0 ||
+ !priv->ref[current->ref_frame_idx[i]].valid) {
av_log(ctx->log_ctx, AV_LOG_ERROR,
"Missing reference frame needed for frame size "
"(ref = %d, ref_frame_idx = %d).\n",
i, current->ref_frame_idx[i]);
return AVERROR_INVALIDDATA;
}
+ ref = &priv->ref[current->ref_frame_idx[i]];
priv->upscaled_width = ref->upscaled_width;
priv->frame_width = ref->frame_width;
More information about the ffmpeg-cvslog
mailing list