MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/hevc_ps: allocate only the required HEVCHdrParams within a VPS

Browse Source 
Fixes: timeout
Fixes: 64033/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5332101272305664

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2024-03-20 20:34:37 -03:00
parent 97d2990ea6
commit 456c8ebe7c
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/hevc_ps.c
View File

@ -438,13 +438,20 @@ static int decode_hrd(GetBitContext *gb, int common_inf_present,
return 0;
}
static void uninit_vps(FFRefStructOpaque opaque, void *obj)
{
HEVCVPS *vps = obj;
av_freep(&vps->hdr);
}
int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
HEVCParamSets *ps)
{
int i,j;
int vps_id = 0;
ptrdiff_t nal_size;
HEVCVPS *vps = ff_refstruct_allocz(sizeof(*vps));
HEVCVPS *vps = ff_refstruct_alloc_ext(sizeof(*vps), 0, NULL, uninit_vps);
if (!vps)
return AVERROR(ENOMEM);
@ -533,6 +540,11 @@ int ff_hevc_decode_nal_vps(GetBitContext *gb, AVCodecContext *avctx,
"vps_num_hrd_parameters %d is invalid\n", vps->vps_num_hrd_parameters);
goto err;
}
vps->hdr = av_calloc(vps->vps_num_hrd_parameters, sizeof(*vps->hdr));
if (!vps->hdr)
goto err;
for (i = 0; i < vps->vps_num_hrd_parameters; i++) {
int common_inf_present = 1;

2
libavcodec/hevc_ps.h
View File

@ -152,7 +152,7 @@ typedef struct PTL {
typedef struct HEVCVPS {
unsigned int vps_id;
HEVCHdrParams hdr[HEVC_MAX_LAYER_SETS];
HEVCHdrParams *hdr;
uint8_t vps_temporal_id_nesting_flag;
int vps_max_layers;