August 2018 - ffmpeg-cvslog - lists.ffmpeg.org

avcodec/mediacodecdec: fix SEGV on modern nvidia decoders
by Aman Gupta 03 Aug '18

03 Aug '18

ffmpeg | branch: release/4.0 | Aman Gupta <aman(a)tmm1.net> | Tue Jul 31 14:33:08 2018 -0700| [fab3418cb9e4661405e669b07498fdfdded39ce3] | committer: Aman Gupta avcodec/mediacodecdec: fix SEGV on modern nvidia decoders This code came originally from gstreamer, where it was added in [1] as a work-around for the Tegra 3. (The alignment was changed in [2] as a response to [3], from 32-bit to 16-bit). gstreamer only used this workaround in the case where the decoder didn't return a slice-height property, but when the code was copied into avcodec the conditional got lost. This commit restores the guard and prefers the slice-height from the decoder when it is available. This fixes segfaults decoding 1920x1080 h264 and mpeg2 videos on the NVidia SHIELD after upgrading to Android Oreo. [1] https://github.com/GStreamer/gst-plugins-bad/commit/a870e6a5c30dd85240fe75c… [2] https://github.com/GStreamer/gst-plugins-bad/commit/21ff3ae0b0127bd82951d27… [3] https://bugzilla.gnome.org/show_bug.cgi?id=748867 Signed-off-by: Aman Gupta <aman(a)tmm1.net> (cherry picked from commit 476fd6ba3a7d74ed8be9af10cb9f4d4b3fdaf3e1) > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fab3418cb9e466140… --- libavcodec/mediacodecdec_common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index 887865a281..f235dae71b 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -389,13 +389,14 @@ static int mediacodec_dec_parse_format(AVCodecContext *avctx, MediaCodecDecConte s->stride = s->stride > 0 ? s->stride : s->width; AMEDIAFORMAT_GET_INT32(s->slice_height, "slice-height", 0); - s->slice_height = s->slice_height > 0 ? s->slice_height : s->height; - if (strstr(s->codec_name, "OMX.Nvidia.")) { + if (strstr(s->codec_name, "OMX.Nvidia.") && s->slice_height == 0) { s->slice_height = FFALIGN(s->height, 16); } else if (strstr(s->codec_name, "OMX.SEC.avc.dec")) { s->slice_height = avctx->height; s->stride = avctx->width; + } else if (s->slice_height == 0) { + s->slice_height = s->height; } AMEDIAFORMAT_GET_INT32(s->color_format, "color-format", 1);

1 0

avcodec/mediacodecdec: fix SEGV on modern nvidia decoders
by Aman Gupta 03 Aug '18

03 Aug '18

ffmpeg | branch: master | Aman Gupta <aman(a)tmm1.net> | Tue Jul 31 14:33:08 2018 -0700| [476fd6ba3a7d74ed8be9af10cb9f4d4b3fdaf3e1] | committer: Aman Gupta avcodec/mediacodecdec: fix SEGV on modern nvidia decoders This code came originally from gstreamer, where it was added in [1] as a work-around for the Tegra 3. (The alignment was changed in [2] as a response to [3], from 32-bit to 16-bit). gstreamer only used this workaround in the case where the decoder didn't return a slice-height property, but when the code was copied into avcodec the conditional got lost. This commit restores the guard and prefers the slice-height from the decoder when it is available. This fixes segfaults decoding 1920x1080 h264 and mpeg2 videos on the NVidia SHIELD after upgrading to Android Oreo. [1] https://github.com/GStreamer/gst-plugins-bad/commit/a870e6a5c30dd85240fe75c… [2] https://github.com/GStreamer/gst-plugins-bad/commit/21ff3ae0b0127bd82951d27… [3] https://bugzilla.gnome.org/show_bug.cgi?id=748867 Signed-off-by: Aman Gupta <aman(a)tmm1.net> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=476fd6ba3a7d74ed8… --- libavcodec/mediacodecdec_common.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/mediacodecdec_common.c b/libavcodec/mediacodecdec_common.c index 887865a281..f235dae71b 100644 --- a/libavcodec/mediacodecdec_common.c +++ b/libavcodec/mediacodecdec_common.c @@ -389,13 +389,14 @@ static int mediacodec_dec_parse_format(AVCodecContext *avctx, MediaCodecDecConte s->stride = s->stride > 0 ? s->stride : s->width; AMEDIAFORMAT_GET_INT32(s->slice_height, "slice-height", 0); - s->slice_height = s->slice_height > 0 ? s->slice_height : s->height; - if (strstr(s->codec_name, "OMX.Nvidia.")) { + if (strstr(s->codec_name, "OMX.Nvidia.") && s->slice_height == 0) { s->slice_height = FFALIGN(s->height, 16); } else if (strstr(s->codec_name, "OMX.SEC.avc.dec")) { s->slice_height = avctx->height; s->stride = avctx->width; + } else if (s->slice_height == 0) { + s->slice_height = s->height; } AMEDIAFORMAT_GET_INT32(s->color_format, "color-format", 1);

1 0

lavc/svq3: Fix regression decoding some files.
by Nikolas Bowe 03 Aug '18

03 Aug '18

ffmpeg | branch: master | Nikolas Bowe <nbowe(a)google.com> | Mon Jul 30 17:22:02 2018 -0700| [5aeb3b008080d8d4a38f245d557dbc9bd6c36dcf] | committer: Michael Niedermayer lavc/svq3: Fix regression decoding some files. Fixes some SVQ3 encoded files which fail to decode correctly after 6d6faa2a2d. These files exhibit lots of artifacts and logs show "Media key encryption is not implemented". However they decode without artifacts before 6d6faa2a2d. The attatched patch allows these files to successfully decode, but also reject media key files. Tested on the files in #6094 and http://samples.mplayerhq.hu/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5aeb3b008080d8d4a… --- libavcodec/svq3.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index fc17081ecf..18a4448ffa 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1064,16 +1064,15 @@ static int svq3_decode_slice_header(AVCodecContext *avctx) av_log(s->avctx, AV_LOG_ERROR, "illegal slice type %u \n", slice_id); return -1; } - if (get_bits1(&s->gb_slice)) { - avpriv_report_missing_feature(s->avctx, "Media key encryption"); - return AVERROR_PATCHWELCOME; - } s->slice_type = ff_h264_golomb_to_pict_type[slice_id]; if ((header & 0x9F) == 2) { - i = (s->mb_num < 64) ? 5 : av_log2(s->mb_num - 1); + i = (s->mb_num < 64) ? 6 : (1 + av_log2(s->mb_num - 1)); get_bits(&s->gb_slice, i); + } else if (get_bits1(&s->gb_slice)) { + avpriv_report_missing_feature(s->avctx, "Media key encryption"); + return AVERROR_PATCHWELCOME; } s->slice_num = get_bits(&s->gb_slice, 8);

1 0

avcodec/mlp_parser: Check if synccode is within buffer
by Michael Niedermayer 03 Aug '18

03 Aug '18

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 29 13:16:37 2018 +0200| [51ac3f43b8bf3b7f2af555af319cd240bb8b4ebf] | committer: Michael Niedermayer avcodec/mlp_parser: Check if synccode is within buffer Fixes: undefined shift Fixes: 9216/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_TRUEHD_fuzzer-6281404575907840 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51ac3f43b8bf3b7f2… --- libavcodec/mlp_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/mlp_parser.c b/libavcodec/mlp_parser.c index 185bd4d667..eb3435b6cb 100644 --- a/libavcodec/mlp_parser.c +++ b/libavcodec/mlp_parser.c @@ -320,7 +320,7 @@ static int mlp_parse(AVCodecParserContext *s, mp->bytes_left = 0; } - sync_present = (AV_RB32(buf + 4) & 0xfffffffe) == 0xf8726fba; + sync_present = buf_size >= 8 && (AV_RB32(buf + 4) & 0xfffffffe) == 0xf8726fba; if (!sync_present) { /* The first nibble of a frame is a parity check of the 4-byte

1 0

avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp()
by Michael Niedermayer 03 Aug '18

03 Aug '18

ffmpeg | branch: master | Michael Niedermayer <michael(a)niedermayer.cc> | Sun Jul 29 12:40:48 2018 +0200| [7dd836a3f9771e0e44df1b27e67d6866d91e06d7] | committer: Michael Niedermayer avcodec/qtrle: Check remaining bytestream in qtrle_decode_XYbpp() Fixes: Timeout Fixes: 9213/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_QTRLE_fuzzer-5649753332252672 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael(a)niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7dd836a3f9771e0e4… --- libavcodec/qtrle.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libavcodec/qtrle.c b/libavcodec/qtrle.c index 670690d0a4..6155b4f3e3 100644 --- a/libavcodec/qtrle.c +++ b/libavcodec/qtrle.c @@ -155,6 +155,8 @@ static inline void qtrle_decode_2n4bpp(QtrleContext *s, int row_ptr, CHECK_PIXEL_PTR(0); while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) { + if (bytestream2_get_bytes_left(&s->g) < 1) + return; if (rle_code == 0) { /* there's another skip code in the stream */ pixel_ptr += (num_pixels * (bytestream2_get_byte(&s->g) - 1)); @@ -210,6 +212,8 @@ static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change) CHECK_PIXEL_PTR(0); while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) { + if (bytestream2_get_bytes_left(&s->g) < 1) + return; if (rle_code == 0) { /* there's another skip code in the stream */ pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1)); @@ -259,6 +263,8 @@ static void qtrle_decode_16bpp(QtrleContext *s, int row_ptr, int lines_to_change CHECK_PIXEL_PTR(0); while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) { + if (bytestream2_get_bytes_left(&s->g) < 1) + return; if (rle_code == 0) { /* there's another skip code in the stream */ pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 2; @@ -303,6 +309,8 @@ static void qtrle_decode_24bpp(QtrleContext *s, int row_ptr, int lines_to_change CHECK_PIXEL_PTR(0); while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) { + if (bytestream2_get_bytes_left(&s->g) < 1) + return; if (rle_code == 0) { /* there's another skip code in the stream */ pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 3; @@ -350,6 +358,8 @@ static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change CHECK_PIXEL_PTR(0); while ((rle_code = (int8_t)bytestream2_get_byte(&s->g)) != -1) { + if (bytestream2_get_bytes_left(&s->g) < 1) + return; if (rle_code == 0) { /* there's another skip code in the stream */ pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;

1 0

avformat/matroskaenc: filter and reorder AV1 OBUs
by James Almer 02 Aug '18

02 Aug '18

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jul 23 12:33:55 2018 -0300| [2de5209d912d1ef153850d67b33dc87ee51c7ec9] | committer: James Almer avformat/matroskaenc: filter and reorder AV1 OBUs Make sure to not write forbidden OBUs to CodecPrivate, and do the same with unnecessary OBUs for packets. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2de5209d912d1ef15… --- libavformat/matroskaenc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index b7ff1950d3..816ddd059a 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -21,6 +21,7 @@ #include <stdint.h> +#include "av1.h" #include "avc.h" #include "hevc.h" #include "avformat.h" @@ -769,6 +770,9 @@ static int mkv_write_native_codecprivate(AVFormatContext *s, AVIOContext *pb, ff_isom_write_hvcc(dyn_cp, par->extradata, par->extradata_size, 0); return 0; + case AV_CODEC_ID_AV1: + return ff_isom_write_av1c(dyn_cp, par->extradata, + par->extradata_size); case AV_CODEC_ID_ALAC: if (par->extradata_size < 36) { av_log(s, AV_LOG_ERROR, @@ -2120,6 +2124,8 @@ static void mkv_write_block(AVFormatContext *s, AVIOContext *pb, (AV_RB24(par->extradata) == 1 || AV_RB32(par->extradata) == 1)) /* extradata is Annex B, assume the bitstream is too and convert it */ ff_hevc_annexb2mp4_buf(pkt->data, &data, &size, 0, NULL); + else if (par->codec_id == AV_CODEC_ID_AV1) + ff_av1_filter_obus_buf(pkt->data, &data, &size); else if (par->codec_id == AV_CODEC_ID_WAVPACK) { int ret = mkv_strip_wavpack(pkt->data, &data, &size); if (ret < 0) {

1 0

avformat/av1: reorder OBUs before writting them in ff_isom_write_av1c()
by James Almer 02 Aug '18

02 Aug '18

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jul 30 15:15:43 2018 -0300| [ded339fb3c8a7364e047f6a19181eb6a7aa18470] | committer: James Almer avformat/av1: reorder OBUs before writting them in ff_isom_write_av1c() Make sure Sequence Header is first, and only allow one of its kind. Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ded339fb3c8a7364e… --- libavformat/av1.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 46 insertions(+), 4 deletions(-) diff --git a/libavformat/av1.c b/libavformat/av1.c index fa34820e12..db7f281fc7 100644 --- a/libavformat/av1.c +++ b/libavformat/av1.c @@ -75,22 +75,45 @@ int ff_av1_filter_obus_buf(const uint8_t *buf, uint8_t **out, int *size) int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size) { + AVIOContext *seq_pb = NULL, *meta_pb = NULL; + uint8_t *seq = NULL, *meta = NULL; int64_t obu_size; int start_pos, type, temporal_id, spatial_id; + int ret, nb_seq = 0, seq_size, meta_size; if (size <= 0) return AVERROR_INVALIDDATA; + ret = avio_open_dyn_buf(&seq_pb); + if (ret < 0) + return ret; + ret = avio_open_dyn_buf(&meta_pb); + if (ret < 0) + goto fail; + while (size > 0) { int len = parse_obu_header(buf, size, &obu_size, &start_pos, &type, &temporal_id, &spatial_id); - if (len < 0) - return len; + if (len < 0) { + ret = len; + goto fail; + } switch (type) { case AV1_OBU_SEQUENCE_HEADER: + nb_seq++; + if (!obu_size || nb_seq > 1) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + avio_write(seq_pb, buf, len); + break; case AV1_OBU_METADATA: - avio_write(pb, buf, len); + if (!obu_size) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + avio_write(meta_pb, buf, len); break; default: break; @@ -99,5 +122,24 @@ int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size) buf += len; } - return 0; + seq_size = avio_close_dyn_buf(seq_pb, &seq); + if (!seq_size) { + ret = AVERROR_INVALIDDATA; + goto fail; + } + avio_write(pb, seq, seq_size); + + meta_size = avio_close_dyn_buf(meta_pb, &meta); + if (meta_size) + avio_write(pb, meta, meta_size); + +fail: + if (!seq) + avio_close_dyn_buf(seq_pb, &seq); + if (!meta) + avio_close_dyn_buf(meta_pb, &meta); + av_free(seq); + av_free(meta); + + return ret; }

1 0

avcodec/av1_parse: return size of the parsed OBU in parse_obu_header()
by James Almer 02 Aug '18

02 Aug '18

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jul 30 15:14:24 2018 -0300| [692e323d893190051c488931bf15eb5c7d340f74] | committer: James Almer avcodec/av1_parse: return size of the parsed OBU in parse_obu_header() Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=692e323d893190051… --- libavcodec/av1_parse.c | 15 +++++++-------- libavcodec/av1_parse.h | 8 +++++++- libavformat/av1.c | 32 ++++++++++++-------------------- 3 files changed, 26 insertions(+), 29 deletions(-) diff --git a/libavcodec/av1_parse.c b/libavcodec/av1_parse.c index 48feb9fb8a..50dd940f03 100644 --- a/libavcodec/av1_parse.c +++ b/libavcodec/av1_parse.c @@ -29,11 +29,12 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx { int64_t obu_size; int start_pos, type, temporal_id, spatial_id; + int len, ret; - int ret = parse_obu_header(buf, length, &obu_size, &start_pos, - &type, &temporal_id, &spatial_id); - if (ret < 0) - return ret; + len = parse_obu_header(buf, length, &obu_size, &start_pos, + &type, &temporal_id, &spatial_id); + if (len < 0) + return len; if (obu_size > INT_MAX / 8 || obu_size < 0) return AVERROR(ERANGE); @@ -42,12 +43,10 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx obu->temporal_id = temporal_id; obu->spatial_id = spatial_id; - length = obu_size + start_pos; - obu->data = buf + start_pos; obu->size = obu_size; obu->raw_data = buf; - obu->raw_size = length; + obu->raw_size = len; ret = init_get_bits(&obu->gb, obu->data, obu->size * 8); if (ret < 0) @@ -57,7 +56,7 @@ int ff_av1_extract_obu(AV1OBU *obu, const uint8_t *buf, int length, void *logctx "obu_type: %d, temporal_id: %d, spatial_id: %d, payload size: %d\n", obu->type, obu->temporal_id, obu->spatial_id, obu->size); - return length; + return len; } int ff_av1_packet_split(AV1Packet *pkt, const uint8_t *buf, int length, void *logctx) diff --git a/libavcodec/av1_parse.h b/libavcodec/av1_parse.h index 3a4151491a..9a6e6835ab 100644 --- a/libavcodec/av1_parse.h +++ b/libavcodec/av1_parse.h @@ -95,6 +95,7 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size, { GetBitContext gb; int ret, extension_flag, has_size_flag; + int64_t size; ret = init_get_bits8(&gb, buf, FFMIN(buf_size, 2 + 8)); // OBU header fields + max leb128 length if (ret < 0) @@ -124,7 +125,12 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size, *start_pos = get_bits_count(&gb) / 8; - return 0; + size = *obu_size + *start_pos; + + if (size > INT_MAX) + return AVERROR(ERANGE); + + return size; } #endif /* AVCODEC_AV1_PARSE_H */ diff --git a/libavformat/av1.c b/libavformat/av1.c index 7c55a100bf..fa34820e12 100644 --- a/libavformat/av1.c +++ b/libavformat/av1.c @@ -33,14 +33,10 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size) size = 0; while (buf < end) { - int ret = parse_obu_header(buf, end - buf, &obu_size, &start_pos, + int len = parse_obu_header(buf, end - buf, &obu_size, &start_pos, &type, &temporal_id, &spatial_id); - if (ret < 0) - return ret; - - obu_size += start_pos; - if (obu_size > INT_MAX) - return AVERROR_INVALIDDATA; + if (len < 0) + return len; switch (type) { case AV1_OBU_TEMPORAL_DELIMITER: @@ -48,11 +44,11 @@ int ff_av1_filter_obus(AVIOContext *pb, const uint8_t *buf, int size) case AV1_OBU_PADDING: break; default: - avio_write(pb, buf, obu_size); - size += obu_size; + avio_write(pb, buf, len); + size += len; break; } - buf += obu_size; + buf += len; } return size; @@ -86,25 +82,21 @@ int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size) return AVERROR_INVALIDDATA; while (size > 0) { - int ret = parse_obu_header(buf, size, &obu_size, &start_pos, + int len = parse_obu_header(buf, size, &obu_size, &start_pos, &type, &temporal_id, &spatial_id); - if (ret < 0) - return ret; - - obu_size += start_pos; - if (obu_size > INT_MAX) - return AVERROR_INVALIDDATA; + if (len < 0) + return len; switch (type) { case AV1_OBU_SEQUENCE_HEADER: case AV1_OBU_METADATA: - avio_write(pb, buf, obu_size); + avio_write(pb, buf, len); break; default: break; } - size -= obu_size; - buf += obu_size; + size -= len; + buf += len; } return 0;

1 0

avformat/av1: return an error when no data is provided to ff_isom_write_av1c()
by James Almer 02 Aug '18

02 Aug '18

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jul 23 13:15:06 2018 -0300| [1e126560c2792e2e141167fb138d6ad1bfed7b39] | committer: James Almer avformat/av1: return an error when no data is provided to ff_isom_write_av1c() Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1e126560c2792e2e1… --- libavformat/av1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/av1.c b/libavformat/av1.c index 7db29c8d76..7c55a100bf 100644 --- a/libavformat/av1.c +++ b/libavformat/av1.c @@ -82,6 +82,9 @@ int ff_isom_write_av1c(AVIOContext *pb, const uint8_t *buf, int size) int64_t obu_size; int start_pos, type, temporal_id, spatial_id; + if (size <= 0) + return AVERROR_INVALIDDATA; + while (size > 0) { int ret = parse_obu_header(buf, size, &obu_size, &start_pos, &type, &temporal_id, &spatial_id);

1 0

avcodec/av1_parse: check for OBU header overread
by James Almer 02 Aug '18

02 Aug '18

ffmpeg | branch: master | James Almer <jamrial(a)gmail.com> | Mon Jul 23 13:12:43 2018 -0300| [4e937b1a60e239335df7623af5eeaa8dd534ee0b] | committer: James Almer avcodec/av1_parse: check for OBU header overread Signed-off-by: James Almer <jamrial(a)gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4e937b1a60e239335… --- libavcodec/av1_parse.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/av1_parse.h b/libavcodec/av1_parse.h index 84fc71c925..3a4151491a 100644 --- a/libavcodec/av1_parse.h +++ b/libavcodec/av1_parse.h @@ -118,6 +118,10 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size, *obu_size = has_size_flag ? leb128(&gb) : buf_size - 1 - extension_flag; + + if (get_bits_left(&gb) < 0) + return AVERROR_INVALIDDATA; + *start_pos = get_bits_count(&gb) / 8; return 0;

1 0