[FFmpeg-cvslog] avcodec/h264_slice: Check idr_pic_id
Michael Niedermayer
git at videolan.org
Sat Oct 9 12:46:49 EEST 2021
ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Wed Sep 29 20:59:56 2021 +0200| [f054871a650f0505bfecf7819f79882067febc12] | committer: Michael Niedermayer
avcodec/h264_slice: Check idr_pic_id
Fixes: left shift of negative value -1
Fixes: 39223/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5498831521841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=f054871a650f0505bfecf7819f79882067febc12
---
libavcodec/h264_slice.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c
index 201b22455c..89ea16a57f 100644
--- a/libavcodec/h264_slice.c
+++ b/libavcodec/h264_slice.c
@@ -1911,8 +1911,13 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl,
sl->max_pic_num = 1 << (sps->log2_max_frame_num + 1);
}
- if (nal->type == H264_NAL_IDR_SLICE)
- sl->idr_pic_id = get_ue_golomb_long(&sl->gb);
+ if (nal->type == H264_NAL_IDR_SLICE) {
+ unsigned idr_pic_id = get_ue_golomb_long(&sl->gb);
+ if (idr_pic_id < 65536) {
+ sl->idr_pic_id = idr_pic_id;
+ } else
+ av_log(h->avctx, AV_LOG_WARNING, "idr_pic_id is invalid\n");
+ }
sl->poc_lsb = 0;
sl->delta_poc_bottom = 0;
More information about the ffmpeg-cvslog
mailing list