avcodec/h264_parser: Fix nalsize check

Fixes: Assertion failure Fixes: 37463/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_H264_fuzzer-4914693494931456

Michael Niedermayer committed 5 years ago

Commit 2d36d2f1 parent 38ab20e1 file · +2 −2Browse files

Unified · Split

libavcodec/h264_parser.c+2−2

@@ -83,12 +83,12 @@ static int h264_find_frame_end(H264ParseContext p, const uint8_t buf, · 82 unmodified lines
83		83
84	for (i = 0; i < buf_size; i++) {	84	for (i = 0; i < buf_size; i++) {
85	if (i >= next_avc) {	85	if (i >= next_avc) {
86	uint32_t nalsize = 0;	86	int64_t nalsize = 0;
87	i = next_avc;	87	i = next_avc;
88	for (j = 0; j < p->nal_length_size; j++)	88	for (j = 0; j < p->nal_length_size; j++)
89	nalsize = (nalsize << 8) \| buf[i++];	89	nalsize = (nalsize << 8) \| buf[i++];
90	if (!nalsize \|\| nalsize > buf_size - i) {	90	if (!nalsize \|\| nalsize > buf_size - i) {
91	av_log(logctx, AV_LOG_ERROR, "AVC-parser: nal size %"PRIu32" "	91	av_log(logctx, AV_LOG_ERROR, "AVC-parser: nal size %"PRId64" "
92	"remaining %d\n", nalsize, buf_size - i);	92	"remaining %d\n", nalsize, buf_size - i);
93	return buf_size;	93	return buf_size;
94	}	94	}