RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hevcdec: Fix undefined memcpy() 

There is likely a better way to fix this, this is mainly to show the problem

Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Fixes: 61753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5022150806077440
Fixes: 58062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4717458841010176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 94bd1796ff)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-07-23 19:45:18 +02:00
parent c4a7dbdbee
commit 938a762473
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/hevcdec.c
View File

@ -1456,7 +1456,8 @@ static void luma_mc_uni(HEVCContext *s, uint8_t *dst, ptrdiff_t dststride,
if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - QPEL_EXTRA_AFTER ||
y_off >= pic_height - block_h - QPEL_EXTRA_AFTER) {
y_off >= pic_height - block_h - QPEL_EXTRA_AFTER ||
ref == s->frame) {
const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset = QPEL_EXTRA_BEFORE * srcstride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
@ -1604,6 +1605,7 @@ static void chroma_mc_uni(HEVCContext *s, uint8_t *dst0,
intptr_t my = av_mod_uintp2(mv->y, 2 + vshift);
intptr_t _mx = mx << (1 - hshift);
intptr_t _my = my << (1 - vshift);
int emu = src0 == s->frame->data[1] || src0 == s->frame->data[2];
x_off += mv->x >> (2 + hshift);
y_off += mv->y >> (2 + vshift);
@ -1611,7 +1613,8 @@ static void chroma_mc_uni(HEVCContext *s, uint8_t *dst0,
if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - EPEL_EXTRA_AFTER ||
y_off >= pic_height - block_h - EPEL_EXTRA_AFTER) {
y_off >= pic_height - block_h - EPEL_EXTRA_AFTER ||
emu) {
const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift));
int buf_offset0 = EPEL_EXTRA_BEFORE *