[libav-stable] [PATCH 1/1] h264: check ref_count validity for num_ref_idx_active_override_flag

Janne Grunau janne-libav at jannau.net
Sat Jan 12 17:22:50 CET 2013


On 2013-01-12 16:59:22 +0100, Reinhard Tartler wrote:
> On Tue, Nov 27, 2012 at 12:41 PM, Janne Grunau <git at libav.org> wrote:
> > Module: libav
> > Branch: master
> > Commit: 6e5cdf26281945ddea3aaf5eca4d127791f23ca8
> >
> > Author:    Janne Grunau <janne-libav at jannau.net>
> > Committer: Janne Grunau <janne-libav at jannau.net>
> > Date:      Sun Nov 25 16:02:02 2012 +0100
> >
> > h264: check ref_count validity for num_ref_idx_active_override_flag
> >
> > Fixes segfault in the fuzzed sample bipbop234.ts_s226407.
> >
> > CC: libav-stable at libav.org
> >
> > ---
> >
> >  libavcodec/h264.c |    7 ++++++-
> >  1 files changed, 6 insertions(+), 1 deletions(-)
> >
> > diff --git a/libavcodec/h264.c b/libavcodec/h264.c
> > index 5440d7b..8226d74 100644
> > --- a/libavcodec/h264.c
> > +++ b/libavcodec/h264.c
> > @@ -2841,8 +2841,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
> >
> >          if (num_ref_idx_active_override_flag) {
> >              h->ref_count[0] = get_ue_golomb(&s->gb) + 1;
> > -            if (h->slice_type_nos == AV_PICTURE_TYPE_B)
> > +            if (h->ref_count[0] < 1)
> > +                return AVERROR_INVALIDDATA;
> > +            if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
> >                  h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
> > +                if (h->ref_count[1] < 1)
> > +                    return AVERROR_INVALIDDATA;
> > +            }
> >          }
> >
> >          if (h->slice_type_nos == AV_PICTURE_TYPE_B)
> >
> 
> This patch does not apply cleanly to 0.8. Do you consider this patch
> important and are willing to help with adapting it?

That was just a whitespace mismatch, updated patch attached

Janne
---8<---

Fixes segfault in the fuzzed sample bipbop234.ts_s226407.

CC: libav-stable at libav.org
Signed-off-by: Janne Grunau <janne-libav at jannau.net>
---
 libavcodec/h264.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/h264.c b/libavcodec/h264.c
index b866917..ec8168e 100644
--- a/libavcodec/h264.c
+++ b/libavcodec/h264.c
@@ -3116,8 +3116,13 @@ static int decode_slice_header(H264Context *h, H264Context *h0){
 
         if(num_ref_idx_active_override_flag){
             h->ref_count[0]= get_ue_golomb(&s->gb) + 1;
-            if(h->slice_type_nos==AV_PICTURE_TYPE_B)
+            if (h->ref_count[0] < 1)
+                return AVERROR_INVALIDDATA;
+            if (h->slice_type_nos == AV_PICTURE_TYPE_B) {
                 h->ref_count[1]= get_ue_golomb(&s->gb) + 1;
+                if (h->ref_count[1] < 1)
+                    return AVERROR_INVALIDDATA;
+            }
         }
 
         if (h->ref_count[0] > max_refs || h->ref_count[1] > max_refs) {
-- 
1.8.1



More information about the libav-stable mailing list