RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-09 00:29:54 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/av1_metadata: don't store the inserted TD OBU in stack

Browse Source 
Fixes: stack-use-after-return
Fixes: clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-5931515701755904
Fixes: clusterfuzz-testcase-minimized-ffmpeg_BSF_AV1_METADATA_fuzzer-6105676541722624

Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2021-04-22 13:15:03 -03:00
parent efdb564504
commit 33f2144d2f
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
libavcodec/av1_metadata_bsf.c
View File

@ -28,6 +28,7 @@ typedef struct AV1MetadataContext {
CBSBSFContext common; CBSBSFContext common;
int td; int td;
AV1RawOBU td_obu;
int color_primaries; int color_primaries;
int transfer_characteristics; int transfer_characteristics;
@ -107,12 +108,11 @@ static int av1_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
CodedBitstreamFragment *frag) CodedBitstreamFragment *frag)
{ {
AV1MetadataContext *ctx = bsf->priv_data; AV1MetadataContext *ctx = bsf->priv_data;
AV1RawOBU td, *obu;
int err, i; int err, i;
for (i = 0; i < frag->nb_units; i++) { for (i = 0; i < frag->nb_units; i++) {
if (frag->units[i].type == AV1_OBU_SEQUENCE_HEADER) { if (frag->units[i].type == AV1_OBU_SEQUENCE_HEADER) {
obu = frag->units[i].content; AV1RawOBU *obu = frag->units[i].content;
err = av1_metadata_update_sequence_header(bsf, &obu->obu.sequence_header); err = av1_metadata_update_sequence_header(bsf, &obu->obu.sequence_header);
if (err < 0) if (err < 0)
return err; return err;
@ -124,12 +124,8 @@ static int av1_metadata_update_fragment(AVBSFContext *bsf, AVPacket *pkt,
if (ctx->td == BSF_ELEMENT_REMOVE) if (ctx->td == BSF_ELEMENT_REMOVE)
ff_cbs_delete_unit(frag, 0); ff_cbs_delete_unit(frag, 0);
} else if (pkt && ctx->td == BSF_ELEMENT_INSERT) { } else if (pkt && ctx->td == BSF_ELEMENT_INSERT) {
td = (AV1RawOBU) {
.header.obu_type = AV1_OBU_TEMPORAL_DELIMITER,
};
err = ff_cbs_insert_unit_content(frag, 0, AV1_OBU_TEMPORAL_DELIMITER, err = ff_cbs_insert_unit_content(frag, 0, AV1_OBU_TEMPORAL_DELIMITER,
&td, NULL); &ctx->td_obu, NULL);
if (err < 0) { if (err < 0) {
av_log(bsf, AV_LOG_ERROR, "Failed to insert Temporal Delimiter.\n"); av_log(bsf, AV_LOG_ERROR, "Failed to insert Temporal Delimiter.\n");
return err; return err;
@ -155,6 +151,12 @@ static const CBSBSFType av1_metadata_type = {
static int av1_metadata_init(AVBSFContext *bsf) static int av1_metadata_init(AVBSFContext *bsf)
{ {
AV1MetadataContext *ctx = bsf->priv_data;
ctx->td_obu = (AV1RawOBU) {
.header.obu_type = AV1_OBU_TEMPORAL_DELIMITER,
};
return ff_cbs_bsf_generic_init(bsf, &av1_metadata_type); return ff_cbs_bsf_generic_init(bsf, &av1_metadata_type);
} }