MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/h264: Increase field_poc to 64bit in ff_h264_init_poc() to detect overflows

Browse Source 
Fixes: Integer overflow
Fixes: 5746/clusterfuzz-testcase-minimized-6270097623613440

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-02-17 04:20:54 +01:00
parent 01370b31ac
commit 1be49cee34
3 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/h264_parse.c
View File

@ -271,7 +271,7 @@ int ff_h264_init_poc(int pic_field_poc[2], int *pic_poc,
int picture_structure, int nal_ref_idc)
{
const int max_frame_num = 1 << sps->log2_max_frame_num;
int field_poc[2];
int64_t field_poc[2];
pc->frame_num_offset = pc->prev_frame_num_offset;
if (pc->frame_num < pc->prev_frame_num)
@ -337,6 +337,10 @@ int ff_h264_init_poc(int pic_field_poc[2], int *pic_poc,
field_poc[1] = poc;
}
if ( field_poc[0] != (int)field_poc[0]
|| field_poc[1] != (int)field_poc[1])
return AVERROR_INVALIDDATA;
if (picture_structure != PICT_BOTTOM_FIELD)
pic_field_poc[0] = field_poc[0];
if (picture_structure != PICT_TOP_FIELD)

4
libavcodec/h264_parser.c
View File

@ -449,8 +449,10 @@ static inline int parse_nal_units(AVCodecParserContext *s,
/* Decode POC of this picture.
* The prev_ values needed for decoding POC of the next picture are not set here. */
field_poc[0] = field_poc[1] = INT_MAX;
ff_h264_init_poc(field_poc, &s->output_picture_number, sps,
ret = ff_h264_init_poc(field_poc, &s->output_picture_number, sps,
&p->poc, p->picture_structure, nal.ref_idc);
if (ret < 0)
goto fail;
/* Continue parsing to check if MMCO_RESET is present.
* FIXME: MMCO_RESET could appear in non-first slice.

4
libavcodec/h264_slice.c
View File

@ -1607,8 +1607,10 @@ static int h264_field_start(H264Context *h, const H264SliceContext *sl,
(h->mb_height * h->mb_stride - 1) * sizeof(*h->slice_table));
}
ff_h264_init_poc(h->cur_pic_ptr->field_poc, &h->cur_pic_ptr->poc,
ret = ff_h264_init_poc(h->cur_pic_ptr->field_poc, &h->cur_pic_ptr->poc,
h->ps.sps, &h->poc, h->picture_structure, nal->ref_idc);
if (ret < 0)
return ret;
memcpy(h->mmco, sl->mmco, sl->nb_mmco * sizeof(*h->mmco));
h->nb_mmco = sl->nb_mmco;