[FFmpeg-devel] [PATCH] lavc/cbs_h2645: Fix incorrect max size of nalu unit

[James Almer]

On 12/6/2019 2:47 PM, Andreas Rheinhardt wrote:
> Andriy Gelman:
>> From: Andriy Gelman <andriy.gelman at gmail.com>
>>
>> In the worst case the startcode prefix has 4 bytes.
>>
>> This fixes a trigerred assertion:
>> Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451
>>
>> Found-by:libFuzzer
>> Signed-off-by: Andriy Gelman <andriy.gelman at gmail.com>
>> ---
>>  libavcodec/cbs_h2645.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
>> index 88fa0029cd6..5f71d805848 100644
>> --- a/libavcodec/cbs_h2645.c
>> +++ b/libavcodec/cbs_h2645.c
>> @@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
>>      max_size = 0;
>>      for (i = 0; i < frag->nb_units; i++) {
>>          // Start code + content with worst-case emulation prevention.
>> -        max_size += 3 + frag->units[i].data_size * 3 / 2;
>> +        max_size += 4 + frag->units[i].data_size * 3 / 2;
>>      }
>>  
>>      data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
>>
> LGTM. I presume you used a NAL unit of size 1?

Pushed then. Thanks.

> 
> (I found this out, too, when I tried (and postponed) to add mp4
> writing support for H.264.)
> 
> - Andreas
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>