[FFmpeg-devel] [PATCH v2] avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices

[Michael Niedermayer]

On Wed, Jul 17, 2024 at 08:42:41AM +0200, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2024-07-15 16:48:25)
> > An alternative would be to leave the context unchanged on failure of hls_slice_header()
> > 
> > Fixes: out of array access
> > Fixes: NULL pointer dereference
> > Fixes: 69584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5931086299856896
> > Fixes: 69724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5104066422702080
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >  libavcodec/hevc/hevcdec.c | 12 ++++++++----
> >  1 file changed, 8 insertions(+), 4 deletions(-)
> > 
> > diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
> > index 0e4b26dad3b..80d59ab1916 100644
> > --- a/libavcodec/hevc/hevcdec.c
> > +++ b/libavcodec/hevc/hevcdec.c
> > @@ -621,6 +621,10 @@ static int hls_slice_header(SliceHeader *sh, const HEVCContext *s, GetBitContext
> >  
> >          if (pps->dependent_slice_segments_enabled_flag)
> >              sh->dependent_slice_segment_flag = get_bits1(gb);
> > +        if (sh->dependent_slice_segment_flag && !s->slice_initialized) {
> > +            av_log(s->avctx, AV_LOG_ERROR, "dependent slice failed\n");
> 
> The new error message seems worse than the old one. A slice is a passive
> object, "slice failed" makes no sense.

will leave the error message


> 
> > @@ -3155,8 +3156,11 @@ static int decode_slice(HEVCContext *s, const H2645NAL *nal, GetBitContext *gb)
> >      int ret;
> >  
> >      ret = hls_slice_header(&s->sh, s, gb);
> > -    if (ret < 0)
> > +    if (ret < 0) {
> > +        //The code is not capable to rewind from an error, the state now is inconsistant so we cannot use it on depandant slices
>                                                                                         ^                                ^
>                                                                                         e                                e
> Also I'd drop everything before the comma, why mention rewinding that is
> not implemented and may not be a good idea anyway.

will word it differently


> 
> Otherwise patch LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240723/b867027d/attachment.sig>