RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/evc_ps: Check log2_sub_gop_length 

Fixes: 1.70141e+38 is outside the range of representable values of type 'int'
Fixes: 59883/clusterfuzz-testcase-minimized-ffmpeg_BSF_EVC_FRAME_MERGE_fuzzer-5557887217565696

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
Michael Niedermayer 2023-06-18 23:50:19 +02:00 committed by James Almer
parent 921596e677
commit 89f98acbf8
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/evc_ps.c
View File

@ -229,6 +229,10 @@ int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size)
if (!sps->sps_pocs_flag || !sps->sps_rpl_flag) { if (!sps->sps_pocs_flag || !sps->sps_rpl_flag) {
sps->log2_sub_gop_length = get_ue_golomb(&gb); sps->log2_sub_gop_length = get_ue_golomb(&gb);
if (sps->log2_sub_gop_length > 5U) {
ret = AVERROR_INVALIDDATA;
goto fail;
}
if (sps->log2_sub_gop_length == 0) if (sps->log2_sub_gop_length == 0)
sps->log2_ref_pic_gap_length = get_ue_golomb(&gb); sps->log2_ref_pic_gap_length = get_ue_golomb(&gb);
} }
@ -288,6 +292,9 @@ int ff_evc_parse_sps(EVCParamSets *ps, const uint8_t *bs, int bs_size)
ps->sps[sps_seq_parameter_set_id] = sps; ps->sps[sps_seq_parameter_set_id] = sps;
return 0; return 0;
fail:
av_free(sps);
return ret;
} }
// @see ISO_IEC_23094-1 (7.3.2.2 SPS RBSP syntax) // @see ISO_IEC_23094-1 (7.3.2.2 SPS RBSP syntax)