mirror of https://git.ffmpeg.org/ffmpeg.git
lavc/cbs_h2645: Fix incorrect max size of nalu unit
In the worst case the startcode prefix has 4 bytes. This fixes a trigerred assertion: Assertion dp <= max_size failed at libavcodec/cbs_h2645.c:1451 Found-by:libFuzzer Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> Signed-off-by: Andriy Gelman <andriy.gelman@gmail.com>
This commit is contained in:
parent
79d907774d
commit
02a83e26de
|
@ -1395,7 +1395,7 @@ static int cbs_h2645_assemble_fragment(CodedBitstreamContext *ctx,
|
|||
max_size = 0;
|
||||
for (i = 0; i < frag->nb_units; i++) {
|
||||
// Start code + content with worst-case emulation prevention.
|
||||
max_size += 3 + frag->units[i].data_size * 3 / 2;
|
||||
max_size += 4 + frag->units[i].data_size * 3 / 2;
|
||||
}
|
||||
|
||||
data = av_realloc(NULL, max_size + AV_INPUT_BUFFER_PADDING_SIZE);
|
||||
|
|
Loading…
Reference in New Issue