mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/hevc: Check entry_point_offsets
Fixes out of array read Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
ec0719264c
commit
ef9f7bbfa4
|
@ -2442,7 +2442,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
|
|||
HEVCLocalContext *lc = s->HEVClc;
|
||||
int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
|
||||
int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
|
||||
int offset;
|
||||
int64_t offset;
|
||||
int startheader, cmpt = 0;
|
||||
int i, j, res = 0;
|
||||
|
||||
|
@ -2489,6 +2489,11 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
|
|||
}
|
||||
if (s->sh.num_entry_point_offsets != 0) {
|
||||
offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;
|
||||
if (length < offset) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");
|
||||
res = AVERROR_INVALIDDATA;
|
||||
goto error;
|
||||
}
|
||||
s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;
|
||||
s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;
|
||||
|
||||
|
@ -2515,6 +2520,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
|
|||
|
||||
for (i = 0; i <= s->sh.num_entry_point_offsets; i++)
|
||||
res += ret[i];
|
||||
error:
|
||||
av_free(ret);
|
||||
av_free(arg);
|
||||
return res;
|
||||
|
|
Loading…
Reference in New Issue