From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 98D24477D1 for ; Tue, 25 Jun 2024 08:59:23 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id A180E68D4BF; Tue, 25 Jun 2024 11:59:22 +0300 (EEST) Received: from mail0.khirnov.net (red.khirnov.net [176.97.15.12]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id C211E68D15B for ; Tue, 25 Jun 2024 11:59:15 +0300 (EEST) Authentication-Results: mail0.khirnov.net; dkim=pass (2048-bit key; unprotected) header.d=khirnov.net header.i=@khirnov.net header.a=rsa-sha256 header.s=mail header.b=nuhCrbMG; dkim-atps=neutral Received: from localhost (localhost [IPv6:::1]) by mail0.khirnov.net (Postfix) with ESMTP id 82C47240DAC for ; Tue, 25 Jun 2024 10:59:15 +0200 (CEST) Received: from mail0.khirnov.net ([IPv6:::1]) by localhost (mail0.khirnov.net [IPv6:::1]) (amavis, port 10024) with ESMTP id v1M4wQUQ77uT for ; Tue, 25 Jun 2024 10:59:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=khirnov.net; s=mail; t=1719305954; bh=IbCgv+6DMfTQBqxZISXE7ptj9vN3bnul153d709VO/w=; h=Subject:From:To:In-Reply-To:References:Date:From; b=nuhCrbMGApe/cr3Iz3R54LaWbPhcwezi3RohXrQI2flaxWxQ+rOhgTKq8o+lSVT01 ihDoqhCiEUbB5r4Nd7mgUFet6iLfY1lmWIMWflr3VkZHGE78igaz2iD1C2Ac3oHZfM 3QBMG55Gqr7krtUNZpiMvc3jLZZyYe5WPf8t4xmiskf0lg9VHu+p5b8wkX0x9sn8zD AmYWxmtYlx8vzg7MP0CUjkWRK+6qwIYMZ1jTOAUJrYdqVXFdv9gl5RcyR5NEEpK4PU JnY+UqxbQyez3w8NT2VL7Sm8xQrDe08bt1H4zPyZSOAwLV9WJ2j0rRN4Ma42FOdgFA hqWlRTWOUIzeQ== Received: from lain.khirnov.net (lain.khirnov.net [IPv6:2001:67c:1138:4306::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "lain.khirnov.net", Issuer "smtp.khirnov.net SMTP CA" (verified OK)) by mail0.khirnov.net (Postfix) with ESMTPS id CBEC52404E5 for ; Tue, 25 Jun 2024 10:59:14 +0200 (CEST) Received: by lain.khirnov.net (Postfix, from userid 1000) id B60811601B9; Tue, 25 Jun 2024 10:59:14 +0200 (CEST) From: Anton Khirnov To: FFmpeg development discussions and patches In-Reply-To: <20240623230137.1749178-2-michael@niedermayer.cc> References: <20240623230137.1749178-1-michael@niedermayer.cc> <20240623230137.1749178-2-michael@niedermayer.cc> Mail-Followup-To: FFmpeg development discussions and patches Date: Tue, 25 Jun 2024 10:59:14 +0200 Message-ID: <171930595471.21847.5930175805645108289@lain.khirnov.net> User-Agent: alot/0.8.1 MIME-Version: 1.0 Subject: Re: [FFmpeg-devel] [PATCH 2/5] avcodec/hevc/hevcdec: Do not allow changes to parameter sets between slices X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: Quoting Michael Niedermayer (2024-06-24 01:01:34) > The slice code detects changes by comparing the pps index. > That way the code cannot detect changes if the sets can change. > > Fixes: out of array access > Fixes: 69585/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6389604524556288 > Fixes: 69601/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5069068613255168 > Fixes: 69621/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6187334182174720 > > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer > --- > libavcodec/hevc/hevcdec.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c > index 1d2e53afc32..d68d454537a 100644 > --- a/libavcodec/hevc/hevcdec.c > +++ b/libavcodec/hevc/hevcdec.c > @@ -3221,17 +3221,20 @@ static int decode_nal_unit(HEVCContext *s, const H2645NAL *nal) > ret = ff_hevc_decode_nal_vps(&gb, s->avctx, &s->ps); > if (ret < 0) > goto fail; > + s->sh.pps_id = -1; This is backwards. If the problem is that the current check does not detect the change, then the check should be fixed. -- Anton Khirnov _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".