[FFmpeg-devel] [PATCH 3/5] avcodec/cbs_h265_syntax_template:

[Michael Niedermayer]

On Fri, Aug 16, 2024 at 08:38:41PM -0300, James Almer wrote:
> On 8/16/2024 8:15 PM, Michael Niedermayer wrote:
> > Fixes: Assertion width > 0 && width <= 32 failed
> > Fixes: 71012/clusterfuzz-testcase-minimized-ffmpeg_BSF_HEVC_METADATA_fuzzer-6073354744823808
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >   libavcodec/cbs_h265_syntax_template.c | 8 ++++++++
> >   1 file changed, 8 insertions(+)
> > 
> > diff --git a/libavcodec/cbs_h265_syntax_template.c b/libavcodec/cbs_h265_syntax_template.c
> > index 12fa185c774..d23cb58e863 100644
> > --- a/libavcodec/cbs_h265_syntax_template.c
> > +++ b/libavcodec/cbs_h265_syntax_template.c
> > @@ -2307,6 +2307,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext
> >           else
> >               length = FFMAX(0, (int)current->exponent_ref_display_width[i] +
> >                                 (int)current->prec_ref_display_width - 31);
> > +
> > +        if (length > 32)
> > +            return AVERROR_PATCHWELCOME;
> 
> I guess this error code is fine since CBS currently can't read values > 32
> and this element can be up to 62 bits long.
> 
> Maybe also print an error that says something like "refDispWidthBits > 32 is
> not supported".
> 
> > +
> >           if (length)
> >               ubs(length, mantissa_ref_display_width[i], 1, i);
> >           else
> > @@ -2318,6 +2322,10 @@ SEI_FUNC(sei_3d_reference_displays_info, (CodedBitstreamContext *ctx, RWContext
> >               else
> >                   length = FFMAX(0, (int)current->exponent_ref_viewing_distance[i] +
> >                                     (int)current->prec_ref_viewing_dist - 31);
> > +
> > +            if (length > 32)
> > +                return AVERROR_PATCHWELCOME;
> 
> Ditto, "refViewDistBits > 32 is not supported".

will apply with these changes

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Good people do not need laws to tell them to act responsibly, while bad
people will find a way around the laws. -- Plato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240818/4d7916cf/attachment.sig>