[FFmpeg-devel] [PATCH 1/3] avcodec/evc_ps: Check chroma_format_idc

[Kieran Kunhya]

On Fri, 13 Oct 2023 at 00:28, Michael Niedermayer <michael at niedermayer.cc>
wrote:

> Fixes: out of array access
> Fixes:
> 62678/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-4858264984354816
>
> Found-by: continuous fuzzing process
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by
> <https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by>:
> Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/evc_ps.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/libavcodec/evc_ps.c b/libavcodec/evc_ps.c
> index c11b92d1c5..19895d404d 100644
> --- a/libavcodec/evc_ps.c
> +++ b/libavcodec/evc_ps.c
> @@ -179,6 +179,10 @@ int ff_evc_parse_sps(GetBitContext *gb, EVCParamSets
> *ps)
>      // 2 - 4:2:2
>      // 3 - 4:4:4
>      sps->chroma_format_idc = get_ue_golomb_31(gb);
> +    if (sps->chroma_format_idc > 3) {
> +        ret = AVERROR_INVALIDDATA;
> +        goto fail;
> +    }
>
>      sps->pic_width_in_luma_samples = get_ue_golomb_long(gb);
>      sps->pic_height_in_luma_samples = get_ue_golomb_long(gb);
> --
> 2.17.1
>

ok