Chiebot-Mirror
/
FFmpeg
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

avcodec/hevcdec: Fix undefined memcpy()

Browse Source 
There is likely a better way to fix this, this is mainly to show the problem

Fixes: MC within same frame resulting in overlapping memcpy()
Fixes: 60189/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4992746590175232
Fixes: 61753/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5022150806077440
Fixes: 58062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4717458841010176

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
pull/390/head
Michael Niedermayer 2 years ago
parent 929eb72876
commit 94bd1796ff
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 5 additions and 2 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 7
      libavcodec/hevcdec.c

7
libavcodec/hevcdec.c
Unescape View File

@ -1563,7 +1563,8 @@ static void luma_mc_uni(HEVCLocalContext *lc, uint8_t *dst, ptrdiff_t dststride,
if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER || if (x_off < QPEL_EXTRA_BEFORE || y_off < QPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - QPEL_EXTRA_AFTER || x_off >= pic_width - block_w - QPEL_EXTRA_AFTER ||
y_off >= pic_height - block_h - QPEL_EXTRA_AFTER) { y_off >= pic_height - block_h - QPEL_EXTRA_AFTER ||
ref == s->frame) {
const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift; const ptrdiff_t edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset = QPEL_EXTRA_BEFORE * srcstride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift); int offset = QPEL_EXTRA_BEFORE * srcstride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift); int buf_offset = QPEL_EXTRA_BEFORE * edge_emu_stride + (QPEL_EXTRA_BEFORE << s->ps.sps->pixel_shift);
@ -1713,6 +1714,7 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
intptr_t my = av_mod_uintp2(mv->y, 2 + vshift); intptr_t my = av_mod_uintp2(mv->y, 2 + vshift);
intptr_t _mx = mx << (1 - hshift); intptr_t _mx = mx << (1 - hshift);
intptr_t _my = my << (1 - vshift); intptr_t _my = my << (1 - vshift);
int emu = src0 == s->frame->data[1] || src0 == s->frame->data[2];
x_off += mv->x >> (2 + hshift); x_off += mv->x >> (2 + hshift);
y_off += mv->y >> (2 + vshift); y_off += mv->y >> (2 + vshift);
@ -1720,7 +1722,8 @@ static void chroma_mc_uni(HEVCLocalContext *lc, uint8_t *dst0,
if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER || if (x_off < EPEL_EXTRA_BEFORE || y_off < EPEL_EXTRA_AFTER ||
x_off >= pic_width - block_w - EPEL_EXTRA_AFTER || x_off >= pic_width - block_w - EPEL_EXTRA_AFTER ||
y_off >= pic_height - block_h - EPEL_EXTRA_AFTER) { y_off >= pic_height - block_h - EPEL_EXTRA_AFTER ||
emu) {
const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift; const int edge_emu_stride = EDGE_EMU_BUFFER_STRIDE << s->ps.sps->pixel_shift;
int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift)); int offset0 = EPEL_EXTRA_BEFORE * (srcstride + (1 << s->ps.sps->pixel_shift));
int buf_offset0 = EPEL_EXTRA_BEFORE * int buf_offset0 = EPEL_EXTRA_BEFORE *

Write Preview
Loading…
Cancel
Save