diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-29 20:59:56 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-09 11:42:16 +0200 |
| commit | f054871a650f0505bfecf7819f79882067febc12 (patch) | |
| tree | 569626642207d16e63122892af2188536b4d0f75 /libavcodec/h264_slice.c | |
| parent | d88d0370d51a1fe243837ee22ae4395c519c8c1e (diff) | |
| download | ffmpeg-f054871a650f0505bfecf7819f79882067febc12.tar.gz | |
avcodec/h264_slice: Check idr_pic_id
Fixes: left shift of negative value -1
Fixes: 39223/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-5498831521841152
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/h264_slice.c')
| -rw-r--r-- | libavcodec/h264_slice.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index 201b22455c..89ea16a57f 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -1911,8 +1911,13 @@ static int h264_slice_header_parse(const H264Context *h, H264SliceContext *sl, sl->max_pic_num = 1 << (sps->log2_max_frame_num + 1); } - if (nal->type == H264_NAL_IDR_SLICE) - sl->idr_pic_id = get_ue_golomb_long(&sl->gb); + if (nal->type == H264_NAL_IDR_SLICE) { + unsigned idr_pic_id = get_ue_golomb_long(&sl->gb); + if (idr_pic_id < 65536) { + sl->idr_pic_id = idr_pic_id; + } else + av_log(h->avctx, AV_LOG_WARNING, "idr_pic_id is invalid\n"); + } sl->poc_lsb = 0; sl->delta_poc_bottom = 0; |