[FFmpeg-devel] [PATCH 2/5] avcodec/hevc/hevcdec: Do not allow changes to parameter sets between slices

[Anton Khirnov]

Quoting Michael Niedermayer (2024-06-24 01:01:34)
> The slice code detects changes by comparing the pps index.
> That way the code cannot detect changes if the sets can change.
> 
> Fixes: out of array access
> Fixes: 69585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6389604524556288
> Fixes: 69601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5069068613255168
> Fixes: 69621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6187334182174720
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/hevc/hevcdec.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
> index 1d2e53afc32..d68d454537a 100644
> --- a/libavcodec/hevc/hevcdec.c
> +++ b/libavcodec/hevc/hevcdec.c
> @@ -3221,17 +3221,20 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal)
>          ret = ff_hevc_decode_nal_vps(&gb, s->avctx, &s->ps);
>          if (ret < 0)
>              goto fail;
> +        s->sh.pps_id = -1;

This is backwards. If the problem is that the current check does not
detect the change, then the check should be fixed.

-- 
Anton Khirnov