[FFmpeg-devel] [PR] avcodec/h264_parser: Check remaining input length in loop in scan_mmco_reset() (PR #21666)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21666 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21666
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21666.patch

Fixes: read of uninitialized memory
Fixes: 476177761/clusterfuzz-testcase-minimized-ffmpeg_dem_H264_fuzzer-6400884824408064

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 78486d79d0bf8051ed8d909df8568a20e4f05b24 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri, 6 Feb 2026 22:05:06 +0100
Subject: [PATCH] avcodec/h264_parser: Check remaining input length in loop in
 scan_mmco_reset()

Fixes: read of uninitialized memory
Fixes: 476177761/clusterfuzz-testcase-minimized-ffmpeg_dem_H264_fuzzer-6400884824408064

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/h264_parser.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/h264_parser.c b/libavcodec/h264_parser.c
index 040739a1d4..a217a0dfe4 100644
--- a/libavcodec/h264_parser.c
+++ b/libavcodec/h264_parser.c
@@ -225,6 +225,9 @@ static int scan_mmco_reset(AVCodecParserContext *s, GetBitContext *gb,
     if (get_bits1(gb)) { // adaptive_ref_pic_marking_mode_flag
         int i;
         for (i = 0; i < H264_MAX_MMCO_COUNT; i++) {
+            if (get_bits_left(gb) < 1)
+                return AVERROR_INVALIDDATA;
+
             MMCOOpcode opcode = get_ue_golomb_31(gb);
             if (opcode > (unsigned) MMCO_LONG) {
                 av_log(logctx, AV_LOG_ERROR,
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org