Stowage/ffmpeg
2
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-15 03:50:31 +00:00
Code Issues Projects Releases Packages Wiki Activity

avcodec/hevc/sei: Use get_bits64() in decode_nal_sei_3d_reference_displays_info()

Browse source 
Fixes: Assertion n>=0 && n<=32 failed at ./libavcodec/get_bits.h:426
Fixes: 468435217/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4644127078940672

Found-by:  continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 8f57b04fe5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2025-12-22 23:03:06 +01:00
parent fa4f6f7526
commit eacb47ec20
No known key found for this signature in database
GPG key ID: B18E8928B3948D64
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
libavcodec/hevc/sei.c
View file

@ -195,7 +195,7 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
else
length = FFMAX(0, (int)s->exponent_ref_display_width[i] +
(int)s->prec_ref_display_width - 31);
s->mantissa_ref_display_width[i] = get_bits_long(gb, length);
s->mantissa_ref_display_width[i] = get_bits64(gb, length);
if (s->ref_viewing_distance_flag) {
s->exponent_ref_viewing_distance[i] = get_bits(gb, 6);
if (s->exponent_ref_viewing_distance[i] > 62)
@ -205,7 +205,7 @@ static int decode_nal_sei_3d_reference_displays_info(HEVCSEITDRDI *s, GetBitCont
else
length = FFMAX(0, (int)s->exponent_ref_viewing_distance[i] +
(int)s->prec_ref_viewing_dist - 31);
s->mantissa_ref_viewing_distance[i] = get_bits_long(gb, length);
s->mantissa_ref_viewing_distance[i] = get_bits64(gb, length);
}
s->additional_shift_present_flag[i] = get_bits1(gb);
if (s->additional_shift_present_flag[i]) {

4
libavcodec/hevc/sei.h
View file

@ -87,9 +87,9 @@ typedef struct HEVCSEITDRDI {
uint16_t left_view_id[32];
uint16_t right_view_id[32];
uint8_t exponent_ref_display_width[32];
uint8_t mantissa_ref_display_width[32];
uint64_t mantissa_ref_display_width[32];
uint8_t exponent_ref_viewing_distance[32];
uint8_t mantissa_ref_viewing_distance[32];
uint64_t mantissa_ref_viewing_distance[32];
uint8_t additional_shift_present_flag[32];
int16_t num_sample_shift[32];
uint8_t three_dimensional_reference_displays_extension_flag;