Skip to content

Commit 5465562

Browse files
committed
avcodec/hevcdec: Avoid only partly skiping duplicate first slices
Fixes: NULL pointer dereference and out of array access Fixes: 13871/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5746167087890432 Fixes: 13845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5650370728034304 This also fixes the return code for explode mode Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: James Almer <jamrial@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 681957b commit 5465562

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

Diff for: libavcodec/hevcdec.c

+10-4
Original file line numberDiff line numberDiff line change
@@ -488,6 +488,11 @@ static int hls_slice_header(HEVCContext *s)
488488

489489
// Coded parameters
490490
sh->first_slice_in_pic_flag = get_bits1(gb);
491+
if (s->ref && sh->first_slice_in_pic_flag) {
492+
av_log(s->avctx, AV_LOG_ERROR, "Two slices reporting being the first in the same frame.\n");
493+
return 1; // This slice will be skiped later, do not corrupt state
494+
}
495+
491496
if ((IS_IDR(s) || IS_BLA(s)) && sh->first_slice_in_pic_flag) {
492497
s->seq_decode = (s->seq_decode + 1) & 0xff;
493498
s->max_ra = INT_MAX;
@@ -2918,6 +2923,11 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
29182923
ret = hls_slice_header(s);
29192924
if (ret < 0)
29202925
return ret;
2926+
if (ret == 1) {
2927+
ret = AVERROR_INVALIDDATA;
2928+
goto fail;
2929+
}
2930+
29212931

29222932
if (
29232933
(s->avctx->skip_frame >= AVDISCARD_BIDIR && s->sh.slice_type == HEVC_SLICE_B) ||
@@ -2927,10 +2937,6 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
29272937
}
29282938

29292939
if (s->sh.first_slice_in_pic_flag) {
2930-
if (s->ref) {
2931-
av_log(s->avctx, AV_LOG_ERROR, "Two slices reporting being the first in the same frame.\n");
2932-
goto fail;
2933-
}
29342940
if (s->max_ra == INT_MAX) {
29352941
if (s->nal_unit_type == HEVC_NAL_CRA_NUT || IS_BLA(s)) {
29362942
s->max_ra = s->poc;

0 commit comments

Comments
 (0)