[FFmpeg-cvslog] lavc/cbs_h2645: Fix incorrect max size of nalu unit

Andriy Gelman git at videolan.org
Fri Dec 6 20:13:09 EET 2019


ffmpeg | branch: master | Andriy Gelman <andriy.gelman at gmail.com> | Fri Dec  6 11:03:02 2019 -0500| [02a83e26de6a58523ee55cfebc1312e7a4e42724] | committer: James Almer

lavc/cbs_h2645: Fix incorrect max size of nalu unit

In the worst case the startcode prefix has 4 bytes.

This fixes a trigerred assertion:
Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451

Found-by:libFuzzer
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt at gmail.com>
Signed-off-by: Andriy Gelman <andriy.gelman at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=02a83e26de6a58523ee55cfebc1312e7a4e42724
---

 libavcodec/cbs_h2645.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
index 88fa0029cd..5f71d80584 100644
--- a/libavcodec/cbs_h2645.c
+++ b/libavcodec/cbs_h2645.c
@@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
     max_size = 0;
     for (i = 0; i < frag->nb_units; i++) {
         // Start code + content with worst-case emulation prevention.
-        max_size += 3 + frag->units[i].data_size * 3 / 2;
+        max_size += 4 + frag->units[i].data_size * 3 / 2;
     }
 
     data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);



More information about the ffmpeg-cvslog mailing list