[FFmpeg-devel] [PATCH 1/2] avcodec/h264_ps: Check for truncation at fixed_frame_rate_flag

[James Almer]

On 12/15/2019 7:00 PM, Michael Niedermayer wrote:
> Fixes: Ticket7249 (No longer displaying a scary red message)
> 
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/h264_ps.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/libavcodec/h264_ps.c b/libavcodec/h264_ps.c
> index e8738d8502..74f12f8979 100644
> --- a/libavcodec/h264_ps.c
> +++ b/libavcodec/h264_ps.c
> @@ -203,6 +203,10 @@ static inline int decode_vui_parameters(GetBitContext *gb, AVCodecContext *avctx
>              sps->num_units_in_tick = num_units_in_tick;
>              sps->time_scale = time_scale;
>          }
> +        if (get_bits_left(gb) == 0) {
> +            av_log(avctx, AV_LOG_WARNING, "Truncated VUI before fixed_frame_rate_flag\n");

This log message is wrong, for that matter. The VUI in these packets
does contain fixed_frame_rate_flag and two more bits. The reason
get_bits_left(gb) is zero at this point is because
ff_h2645_packet_split() skips what it assumes are the rbsp_stop_one_bit
and any potential rbsp_alignment_zero_bits at the end of a NAL, and in
this case fixed_frame_rate_flag happened to be the last 1.

> +            return 0;
> +        }
>          sps->fixed_frame_rate_flag = get_bits1(gb);
>      }
>  
>