> -----Original Message-----
> From: ffmpeg-devel <ffmpeg-devel-boun...@ffmpeg.org> On Behalf Of Michael
> Niedermayer
> Sent: Saturday, December 16, 2023 8:16 PM
> To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
> Subject: [FFmpeg-devel] [PATCH 2/4] avcodec/cbs_vp8: Do not use assert to
> check for end
>
> Fixes: abort()
> Fixes: 64232/clusterfuzz-testcase-minimized-
> ffmpeg_BSF_TRACE_HEADERS_fuzzer-5417957987319808
>
> Found-by: continuous fuzzing process https://github.com/google/oss-
> fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
> ---
> libavcodec/cbs_vp8.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/cbs_vp8.c b/libavcodec/cbs_vp8.c index
> 01d4b9cefef..b76cde98517 100644
> --- a/libavcodec/cbs_vp8.c
> +++ b/libavcodec/cbs_vp8.c
> @@ -329,7 +329,9 @@ static int cbs_vp8_read_unit(CodedBitstreamContext
> *ctx,
>
> pos = get_bits_count(&gbc);
> pos /= 8;
> - av_assert0(pos <= unit->data_size);
> +
> + if (pos > unit->data_size)
> + return AVERROR_INVALIDDATA;
>
This is a potentially fatal error caused by the parser overreading past the
expected data. This should not occur after the fix GetBitContext setup patch
was applied.
BTW, the VP8 compressed header does not guarantee 8-bit alignment according to
the SPEC.
It could be better to check the bit pos.
```
pos = get_bits_count(&gbc);
av_assert0(pos <= unit->data_size * 8);
```
> frame->data_ref = av_buffer_ref(unit->data_ref);
> if (!frame->data_ref)
> --
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org
> with
> subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
