dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 09:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/cavsdec: reject invalid start-code bitreader sizes

Browse Source 
Fixes: NULL pointer dereference
Fixes: 4jy_poc_cavs.zip / poc_cavs.avi
Fixes: UH66Y8Om9F8X
Found-by: Jiale Yao <yaojiale02@163.com>
(cherry picked from commit 9c2aabaa34)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-11 16:46:17 +02:00
parent bd2541b8da
commit e596a3302a
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/cavsdec.c
View File

@@ -1266,10 +1266,11 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
av_log(h->avctx, AV_LOG_WARNING, "no frame decoded\n");
return FFMAX(0, buf_ptr - buf);
}
input_size = (buf_end - buf_ptr) * 8;
input_size = buf_end - buf_ptr;
if ((ret = init_get_bits8(&h->gb, buf_ptr, input_size)) < 0)
return ret;
switch (stc) {
case CAVS_START_CODE:
init_get_bits(&h->gb, buf_ptr, input_size);
decode_seq_header(h);
break;
case PIC_I_START_CODE:
@@ -1288,7 +1289,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
*got_frame = 0;
if (!h->got_keyframe)
break;
init_get_bits(&h->gb, buf_ptr, input_size);
h->stc = stc;
if (decode_pic(h))
break;
@@ -1312,7 +1312,6 @@ static int cavs_decode_frame(AVCodecContext *avctx, AVFrame *rframe,
break;
default:
if (stc <= SLICE_MAX_START_CODE) {
init_get_bits(&h->gb, buf_ptr, input_size);
decode_slice_header(h, &h->gb);
}
break;