]> git.sesse.net Git - ffmpeg/commit
cbs_sei: Detect payload overflows when reading SEI messages
authorMark Thompson <sw@jkqxz.net>
Tue, 2 Feb 2021 20:58:11 +0000 (20:58 +0000)
committerMark Thompson <sw@jkqxz.net>
Fri, 12 Mar 2021 22:45:33 +0000 (22:45 +0000)
commit2c96e6cb955af3062e78c5b0f9fb907cfb2e59e3
tree23f0583aba572b823d56f343bd622f8e490c5adb
parentb128b0ce2203f96ff86969f6d0039827a7f00378
cbs_sei: Detect payload overflows when reading SEI messages

The top-level GetBitContext is sized for the whole NAL unit, so it fails
to detect overflows where a payload continues into the following message.
To fix that, we make a new context on the stack for reading each payload.

Fixes: 29892/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_REDUNDANT_PPS_fuzzer-6310830956216320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Tested-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/cbs_sei_syntax_template.c