ubeddulla opened a new pull request, #3483: URL: https://github.com/apache/brpc/pull/3483
avc_nalu_read_uev adds every Exp-Golomb value bit at the constant shift leadingZeroBits-1 instead of the descending leadingZeroBits-1-i, so any ue(v) code with two or more leading zero bits decodes to the wrong number and a crafted SPS overflows the int32 accumulator past INT32_MAX (UBSan reports the signed overflow). The decoder runs on the SPS inside an untrusted RTMP AVC sequence header, reached through AVCDecoderConfigurationRecord::Create. Shift each bit into its correct position so the result matches the H.264 read_bits(leadingZeroBits) semantics and stays in range. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
