Re: [FFmpeg-devel] [PATCH v2] avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH v2] avcodec/hevc/hevcdec: Do not allow slices to depend on failed slices
Date: Tue, 23 Jul 2024 20:27:42 +0200
Message-ID: <20240723182742.GA4991@pb2> (raw)
In-Reply-To: <172119856184.21847.8183623909028998274@lain.khirnov.net>

[-- Attachment #1.1: Type: text/plain, Size: 2538 bytes --]

On Wed, Jul 17, 2024 at 08:42:41AM +0200, Anton Khirnov wrote:
> Quoting Michael Niedermayer (2024-07-15 16:48:25)
> > An alternative would be to leave the context unchanged on failure of hls_slice_header()
> > 
> > Fixes: out of array access
> > Fixes: NULL pointer dereference
> > Fixes: 69584/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5931086299856896
> > Fixes: 69724/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5104066422702080
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/hevc/hevcdec.c | 12 ++++++++----
> >  1 file changed, 8 insertions(+), 4 deletions(-)
> > 
> > diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c
> > index 0e4b26dad3b..80d59ab1916 100644
> > --- a/libavcodec/hevc/hevcdec.c
> > +++ b/libavcodec/hevc/hevcdec.c
> > @@ -621,6 +621,10 @@ static int hls_slice_header(SliceHeader *sh, const HEVCContext *s, GetBitContext
> >  
> >          if (pps->dependent_slice_segments_enabled_flag)
> >              sh->dependent_slice_segment_flag = get_bits1(gb);
> > +        if (sh->dependent_slice_segment_flag && !s->slice_initialized) {
> > +            av_log(s->avctx, AV_LOG_ERROR, "dependent slice failed\n");
> 
> The new error message seems worse than the old one. A slice is a passive
> object, "slice failed" makes no sense.

will leave the error message

> 
> > @@ -3155,8 +3156,11 @@ static int decode_slice(HEVCContext *s, const H2645NAL *nal, GetBitContext *gb)
> >      int ret;
> >  
> >      ret = hls_slice_header(&s->sh, s, gb);
> > -    if (ret < 0)
> > +    if (ret < 0) {
> > +        //The code is not capable to rewind from an error, the state now is inconsistant so we cannot use it on depandant slices
>                                                                                         ^                                ^
>                                                                                         e                                e
> Also I'd drop everything before the comma, why mention rewinding that is
> not implemented and may not be a good idea anyway.

will word it differently

> 
> Otherwise patch LGTM.

will apply

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".