[FFmpeg-cvslog] avcodec/cbs: ensure user_data is padded for GBC parsing

[Aman Gupta]

ffmpeg | branch: master | Aman Gupta <aman at tmm1.net> | Fri Oct  5 11:36:51 2018 -0700| [41ed2c384993da0cbc69657f05bec3c9b21b78bf] | committer: Aman Gupta

avcodec/cbs: ensure user_data is padded for GBC parsing

Fixes crash noticed in the cbs_userdata patchset.

====ERROR: AddressSanitizer: heap-buffer-overflow on address 0x609000026c89 at pc 0x00010725d37b bp 0x7ffeea04e750 sp 0x7ffeea04e748
READ of size 4 at 0x609000026c89 thread T0
    #0 0x10725d37a in ff_cbs_read_unsigned get_bits.h:274
    #1 0x1072d2767 in ff_cbs_read_a53_user_data cbs_misc_syntax_template.c:119
    #2 0x1078251a7 in h264_metadata_filter h264_metadata_bsf.c:595
    #3 0x105c1321d in output_packet ffmpeg.c:853

0x609000026c89 is located 1 bytes to the right of 8-byte region [0x609000026c80,0x609000026c88)
allocated by thread T0 here:
    #0 0x10aef08d7 in wrap_posix_memalign (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x578d7)
    #1 0x10aca95e6 in av_malloc mem.c:87
    #2 0x10ac545fe in av_buffer_allocz buffer.c:72
    #3 0x107263b27 in cbs_h264_read_nal_unit cbs_h264_syntax_template.c:722
    #4 0x10725b688 in cbs_read_fragment_content cbs.c:155

Signed-off-by: Aman Gupta <aman at tmm1.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=41ed2c384993da0cbc69657f05bec3c9b21b78bf
---

 libavcodec/cbs_h264_syntax_template.c  | 2 +-
 libavcodec/cbs_mpeg2_syntax_template.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/cbs_h264_syntax_template.c b/libavcodec/cbs_h264_syntax_template.c
index 106da0630e..1c8d7d5eae 100644
--- a/libavcodec/cbs_h264_syntax_template.c
+++ b/libavcodec/cbs_h264_syntax_template.c
@@ -725,7 +725,7 @@ static int FUNC(sei_user_data_registered)(CodedBitstreamContext *ctx, RWContext
     *payload_size = i + current->data_length;
 #endif
 
-    allocate(current->data, current->data_length);
+    allocate(current->data, current->data_length + AV_INPUT_BUFFER_PADDING_SIZE);
     for (j = 0; j < current->data_length; j++)
         xu(8, itu_t_t35_payload_byte[i], current->data[j], 0x00, 0xff, 1, i + j);
 
diff --git a/libavcodec/cbs_mpeg2_syntax_template.c b/libavcodec/cbs_mpeg2_syntax_template.c
index 8b5d35437e..88cf453b17 100644
--- a/libavcodec/cbs_mpeg2_syntax_template.c
+++ b/libavcodec/cbs_mpeg2_syntax_template.c
@@ -71,7 +71,7 @@ static int FUNC(user_data)(CodedBitstreamContext *ctx, RWContext *rw,
     av_assert0(k % 8 == 0);
     current->user_data_length = k /= 8;
     if (k > 0) {
-        current->user_data_ref = av_buffer_alloc(k);
+        current->user_data_ref = av_buffer_allocz(k + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!current->user_data_ref)
             return AVERROR(ENOMEM);
         current->user_data = current->user_data_ref->data;