apps/ffmpeg-rockchip
1
0
Fork 0
mirror of https://github.com/nyanmisaka/ffmpeg-rockchip.git synced 2025-11-03 01:33:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use

Browse Source 
Fixes: index -1 out of bounds for type 'AV1ReferenceFrameState [8]'
Fixes: 16079/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5758807440883712

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: James Almer <jamrial@gmail.com>
See: [FFmpeg-devel] [PATCH 05/13] avcodec/cbs_av1_syntax_template: Check ref_frame_idx before use
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2019-08-04 09:51:26 +02:00
parent 392c028cd2
commit 8174e5c77d
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/cbs_av1_syntax_template.c
View File

@@ -419,16 +419,17 @@ static int FUNC(frame_size_with_refs)(CodedBitstreamContext *ctx, RWContext *rw,
for (i = 0; i < AV1_REFS_PER_FRAME; i++) { for (i = 0; i < AV1_REFS_PER_FRAME; i++) {
flags(found_ref[i], 1, i); flags(found_ref[i], 1, i);
if (current->found_ref[i]) { if (current->found_ref[i]) {
AV1ReferenceFrameState *ref = AV1ReferenceFrameState *ref;
&priv->ref[current->ref_frame_idx[i]];
if (!ref->valid) { if (current->ref_frame_idx[i] < 0 ||
!priv->ref[current->ref_frame_idx[i]].valid) {
av_log(ctx->log_ctx, AV_LOG_ERROR, av_log(ctx->log_ctx, AV_LOG_ERROR,
"Missing reference frame needed for frame size " "Missing reference frame needed for frame size "
"(ref = %d, ref_frame_idx = %d).\n", "(ref = %d, ref_frame_idx = %d).\n",
i, current->ref_frame_idx[i]); i, current->ref_frame_idx[i]);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
ref = &priv->ref[current->ref_frame_idx[i]];
priv->upscaled_width = ref->upscaled_width; priv->upscaled_width = ref->upscaled_width;
priv->frame_width = ref->frame_width; priv->frame_width = ref->frame_width;