[FFmpeg-devel] [PATCH] avcodec/h264_mp4toannexb: Fix heap buffer overflow

[Michael Niedermayer]

On Mon, Mar 25, 2024 at 04:09:00PM +0800, Zhao Zhili wrote:
> From: Zhao Zhili <zhilizhao at tencent.com>
> 
> Fixes: out of array write
> Fixes: 64407/clusterfuzz-testcase-minimized-ffmpeg_BSF_H264_MP4TOANNEXB_fuzzer-4966763443650560
> 
> mp4toannexb_filter counts the number of bytes needed in the first
> pass and allocate the memory, then do memcpy in the second pass.
> Update sps/pps size in the loop makes the count invalid in the
> case of SPS/PPS occur after IDR slice. This patch process in-band
> SPS/PPS before the two pass loops.
> ---
>  libavcodec/bsf/h264_mp4toannexb.c | 59 ++++++++++++++++++++++++-------
>  1 file changed, 46 insertions(+), 13 deletions(-)

I confirm this fixes the testcase

this or some other fix is needed for 7.0

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Everything should be made as simple as possible, but not simpler.
-- Albert Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20240325/0f1d1bf0/attachment.sig>