[FFmpeg-cvslog] avcodec/hevcdec: Fix undefined memcpy()
Michael Niedermayer
git at videolan.org
Mon Oct 30 02:10:35 EET 2023
ffmpeg | branch: release/5.1 | Michael Niedermayer <michael at niedermayer.cc> | Sun Jul 23 19:45:18 2023 +0200| [54d87e4b283734f1a97cb1b5c7e7d76f4056cdac] | committer: Michael Niedermayer
avcodec/hevcdec: Fix undefined memcpy()
There is likely a better way to fix this, this is mainly to show the problem
Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Fixes: 61753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5022150806077440
Fixes: 58062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4717458841010176
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 94bd1796ff45b396021cd260e9b037bc61815933)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=54d87e4b283734f1a97cb1b5c7e7d76f4056cdac
---
libavcodec/hevcdec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index 492a0e7e68..2e3ee9dc6e 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -1517,7 +1517,8 @@ static void luma_mc_uni(HEVCContext *s, uint8_t *dst, ptrdiff_t dststride,
if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - QPEL_EXTRA_AFTER ||
- y_off >= pic_height - block_h - QPEL_EXTRA_AFTER) {
+ y_off >= pic_height - block_h - QPEL_EXTRA_AFTER ||
+ ref == s->frame) {
const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset = QPEL_EXTRA_BEFORE * srcstride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
@@ -1665,6 +1666,7 @@ static void chroma_mc_uni(HEVCContext *s, uint8_t *dst0,
intptr_t my = av_mod_uintp2(mv->y, 2 + vshift);
intptr_t _mx = mx << (1 - hshift);
intptr_t _my = my << (1 - vshift);
+ int emu = src0 == s->frame->data[1] || src0 == s->frame->data[2];
x_off += mv->x >> (2 + hshift);
y_off += mv->y >> (2 + vshift);
@@ -1672,7 +1674,8 @@ static void chroma_mc_uni(HEVCContext *s, uint8_t *dst0,
if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - EPEL_EXTRA_AFTER ||
- y_off >= pic_height - block_h - EPEL_EXTRA_AFTER) {
+ y_off >= pic_height - block_h - EPEL_EXTRA_AFTER ||
+ emu) {
const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift));
int buf_offset0 = EPEL_EXTRA_BEFORE *
More information about the ffmpeg-cvslog
mailing list