Re: [FFmpeg-devel] [PATCH 3/3] avcodec/hevcdec: Fix null dereference in hevc_frame_end()

From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
To: ffmpeg-devel@ffmpeg.org
Subject: Re: [FFmpeg-devel] [PATCH 3/3] avcodec/hevcdec: Fix null dereference in hevc_frame_end()
Date: Mon, 1 Apr 2024 14:23:57 +0200
Message-ID: <GV1P250MB0737DCF49ACD522CF62256ED8F3F2@GV1P250MB0737.EURP250.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <20240401020006.12107-3-michael@niedermayer.cc>

Michael Niedermayer:
> Fixes: member access within null pointer of type 'const AVFilmGrainParams' (aka 'const struct AVFilmGrainParams')
> Fixes: 67701/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-6595117570916352
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/hevcdec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
> index 752459af2d3..2514d522ba5 100644
> --- a/libavcodec/hevcdec.c
> +++ b/libavcodec/hevcdec.c
> @@ -2945,6 +2945,8 @@ static int hevc_frame_end(HEVCContext *s)
>      if (out->needs_fg) {
>          av_assert0(out->frame_grain->buf[0]);
>          fgp = av_film_grain_params_select(out->frame);
> +        if (!fgp)
> +            return 0;
>          switch (fgp->type) {
>          case AV_FILM_GRAIN_PARAMS_NONE:
>              av_assert0(0);

There seems to be a deeper logic bug here: If there is no usable (as
defined by av_film_grain_params_select()) film grain stuff here, then
the frame_grain frame will be "blank" (may contain e.g. an earlier
frame, but definitely not the one it is supposed to have), but it will
nevertheless be the frame to be output.

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".