[FFmpeg-devel] [PATCH 3/3] avcodec/cbs_h2645: Avoid an unchecked bytesteram read

[James Almer]

On 7/24/2023 9:46 PM, Michael Niedermayer wrote:
> The unchecked read caused the 2nd subsequent tell call to move backward resulting
> in a negative length
> 
> Fixes: assertion failure
> Fixes: 60276/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5434126636023808
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavcodec/cbs_h2645.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavcodec/cbs_h2645.c b/libavcodec/cbs_h2645.c
> index 34c5d1d372..21c8bc76d5 100644
> --- a/libavcodec/cbs_h2645.c
> +++ b/libavcodec/cbs_h2645.c
> @@ -695,7 +695,7 @@ static int cbs_h2645_split_fragment(CodedBitstreamContext *ctx,
>               int nal_unit_type = bytestream2_get_byte(&gbc) & 0x1f;
>               unsigned int num_nalus = 1;
>               if(nal_unit_type != VVC_DCI_NUT && nal_unit_type != VVC_OPI_NUT)
> -                num_nalus = bytestream2_get_be16u(&gbc);
> +                num_nalus = bytestream2_get_be16(&gbc);
>   
>               start = bytestream2_tell(&gbc);
>               for(i = 0; i < num_nalus; i++) {

LGTM.