RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mpegvideo_enc: Do not duplicate pictures on shifting 

Fixes: out of array access
Fixes: 69098/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG2VIDEO_fuzzer-6107989688778752
Fixes: 69599/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEG4_fuzzer-4848626296225792.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c8881cb35)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-20 00:44:08 +02:00
parent 35be459c27
commit 0e2bff1a88
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/mpegvideo_enc.c
View File

@ -1297,6 +1297,8 @@ static int load_input_picture(MpegEncContext *s, const AVFrame *pic_arg)
/* shift buffer entries */ /* shift buffer entries */
for (i = flush_offset; i < MAX_PICTURE_COUNT /*s->encoding_delay + 1*/; i++) for (i = flush_offset; i < MAX_PICTURE_COUNT /*s->encoding_delay + 1*/; i++)
s->input_picture[i - flush_offset] = s->input_picture[i]; s->input_picture[i - flush_offset] = s->input_picture[i];
for (int i = MAX_B_FRAMES + 1 - flush_offset; i <= MAX_B_FRAMES; i++)
s->input_picture[i] = NULL;
s->input_picture[encoding_delay] = (Picture*) pic; s->input_picture[encoding_delay] = (Picture*) pic;