[FFmpeg-cvslog] avcodec/h264_picture: don't assume Film Grain Params side data will be present

[James Almer]

ffmpeg | branch: master | James Almer <jamrial at gmail.com> | Sun Oct 17 13:25:04 2021 -0300| [762e18da3fe64dbe7d3091fddf99aeee164017cc] | committer: James Almer

avcodec/h264_picture: don't assume Film Grain Params side data will be present

If a decoding error happens before frame side data is allocated, this assert may be
triggered. And since applying film grain is not enforced (we just warn it wasn't
applied and move on), we can just do that in such scenarios.

Fixes: Assertion failure
Fixes: clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5528650032742400

Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=762e18da3fe64dbe7d3091fddf99aeee164017cc
---

 libavcodec/h264_picture.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/h264_picture.c b/libavcodec/h264_picture.c
index 66fd9bc4cb..adf8a32378 100644
--- a/libavcodec/h264_picture.c
+++ b/libavcodec/h264_picture.c
@@ -252,9 +252,11 @@ int ff_h264_field_end(H264Context *h, H264SliceContext *sl, int in_setup)
                    "hardware accelerator failed to decode picture\n");
     } else if (!in_setup && cur->needs_fg && (!FIELD_PICTURE(h) || !h->first_field)) {
         AVFrameSideData *sd = av_frame_get_side_data(cur->f, AV_FRAME_DATA_FILM_GRAIN_PARAMS);
-        av_assert0(sd); // always present if `cur->needs_fg`
-        err = ff_h274_apply_film_grain(cur->f_grain, cur->f, &h->h274db,
-                                       (AVFilmGrainParams *) sd->data);
+
+        err = AVERROR_INVALIDDATA;
+        if (sd) // a decoding error may have happened before the side data could be allocated
+            err = ff_h274_apply_film_grain(cur->f_grain, cur->f, &h->h274db,
+                                           (AVFilmGrainParams *) sd->data);
         if (err < 0) {
             av_log(h->avctx, AV_LOG_WARNING, "Failed synthesizing film "
                    "grain, ignoring: %s\n", av_err2str(err));