[FFmpeg-devel] [PATCH 2/3] avcodec/cbs_h266_syntax_template: Check num_subpic_cols for 0

[James Almer]

On 7/25/2023 6:03 PM, Michael Niedermayer wrote:
> On Mon, Jul 24, 2023 at 10:54:20PM -0300, James Almer wrote:
>> On 7/24/2023 9:46 PM, Michael Niedermayer wrote:
>>> Fixes: division by zero
>>> Fixes: 60306/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5538913553612800
>>>
>>> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
>>> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
>>> ---
>>>    libavcodec/cbs_h266_syntax_template.c | 2 ++
>>>    1 file changed, 2 insertions(+)
>>>
>>> diff --git a/libavcodec/cbs_h266_syntax_template.c b/libavcodec/cbs_h266_syntax_template.c
>>> index dce0216fbc..18ecf17e3b 100644
>>> --- a/libavcodec/cbs_h266_syntax_template.c
>>> +++ b/libavcodec/cbs_h266_syntax_template.c
>>> @@ -1187,6 +1187,8 @@ static int FUNC(sps)(CodedBitstreamContext *ctx, RWContext *rw,
>>>                    } else {
>>>                        int num_subpic_cols = tmp_width_val /
>>>                                         (current->sps_subpic_width_minus1[0] + 1);
>>> +                    if (!num_subpic_cols)
>>> +                        return AVERROR_INVALIDDATA;
>>>                        infer(sps_subpic_ctu_top_left_x[i],
>>>                              (i % num_subpic_cols) *
>>>                              (current->sps_subpic_width_minus1[0] + 1));
>>
>> Does the following fix it too?
> 
> yes, feel free to push this, or i can if you prefer?

Just pushed it. Thanks.