This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 125bb2e045 avcodec/lcevc_parser: Check that block_size is not negative
125bb2e045 is described below
commit 125bb2e045fda63701a0d7ec0464129d18210617
Author: James Almer <[email protected]>
AuthorDate: Sun Mar 8 21:07:55 2026 -0300
Commit: James Almer <[email protected]>
CommitDate: Mon Mar 9 18:39:33 2026 -0300
avcodec/lcevc_parser: Check that block_size is not negative
Based on 248b481c337d917e0fece9555ae59b5375c725c6
Signed-off-by: James Almer <[email protected]>
---
libavcodec/bsf/extract_extradata.c | 17 +-------------
libavcodec/{x86/g722dsp_init.c => lcevc_parse.h} | 29 +++++++++++++++---------
libavcodec/lcevc_parser.c | 23 +++++--------------
3 files changed, 25 insertions(+), 44 deletions(-)
diff --git a/libavcodec/bsf/extract_extradata.c
b/libavcodec/bsf/extract_extradata.c
index 08293ea7e1..51879b0f85 100644
--- a/libavcodec/bsf/extract_extradata.c
+++ b/libavcodec/bsf/extract_extradata.c
@@ -30,6 +30,7 @@
#include "h2645_parse.h"
#include "h264.h"
#include "lcevc.h"
+#include "lcevc_parse.h"
#include "startcode.h"
#include "vc1_common.h"
#include "vvc.h"
@@ -268,22 +269,6 @@ static int extract_extradata_h2645(AVBSFContext *ctx,
AVPacket *pkt,
return 0;
}
-static inline uint64_t get_mb(GetBitContext *s) {
- int more, i = 0;
- uint64_t mb = 0;
-
- do {
- int byte = get_bits(s, 8);
- unsigned bits = byte & 0x7f;
- more = byte & 0x80;
- mb = (mb << 7) | bits;
- if (++i == 10)
- break;
- } while (more);
-
- return mb;
-}
-
/**
* Rewrite the NALu stripping the unneeded blocks.
* Given that length fields coded inside the NALu are not aware of any
emulation_3bytes
diff --git a/libavcodec/x86/g722dsp_init.c b/libavcodec/lcevc_parse.h
similarity index 64%
copy from libavcodec/x86/g722dsp_init.c
copy to libavcodec/lcevc_parse.h
index 614695193b..f56758a1a5 100644
--- a/libavcodec/x86/g722dsp_init.c
+++ b/libavcodec/lcevc_parse.h
@@ -1,6 +1,4 @@
/*
- * Copyright (c) 2014 James Almer
- *
* This file is part of FFmpeg.
*
* FFmpeg is free software; you can redistribute it and/or
@@ -18,18 +16,27 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+#ifndef AVCODEC_LCEVC_PARSE_H
+#define AVCODEC_LCEVC_PARSE_H
+
#include <stdint.h>
-#include "libavutil/attributes.h"
-#include "libavutil/x86/cpu.h"
-#include "libavcodec/g722dsp.h"
+#include "get_bits.h"
-void ff_g722_apply_qmf_sse2(const int16_t *prev_samples, int xout[2]);
+static inline uint64_t get_mb(GetBitContext *s) {
+ int more, i = 0;
+ uint64_t mb = 0;
-av_cold void ff_g722dsp_init_x86(G722DSPContext *dsp)
-{
- int cpu_flags = av_get_cpu_flags();
+ do {
+ int byte = get_bits(s, 8);
+ unsigned bits = byte & 0x7f;
+ more = byte & 0x80;
+ mb = (mb << 7) | bits;
+ if (++i == 10)
+ break;
+ } while (more);
- if (EXTERNAL_SSE2(cpu_flags))
- dsp->apply_qmf = ff_g722_apply_qmf_sse2;
+ return mb;
}
+
+#endif /* AVCODEC_LCEVC_PARSE_H */
diff --git a/libavcodec/lcevc_parser.c b/libavcodec/lcevc_parser.c
index 77888a3efc..f3338c4659 100644
--- a/libavcodec/lcevc_parser.c
+++ b/libavcodec/lcevc_parser.c
@@ -25,6 +25,7 @@
#include "get_bits.h"
#include "h2645_parse.h"
#include "lcevc.h"
+#include "lcevc_parse.h"
#include "parser.h"
#include "parser_internal.h"
@@ -100,22 +101,6 @@ static const struct {
{ 7680, 4800 },
};
-static inline uint64_t get_mb(GetBitContext *s) {
- int more, i = 0;
- uint64_t mb = 0;
-
- do {
- int byte = get_bits(s, 8);
- unsigned bits = byte & 0x7f;
- more = byte & 0x80;
- mb = (mb << 7) | bits;
- if (++i == 10)
- break;
- } while (more);
-
- return mb;
-}
-
static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx,
const H2645NAL *nal)
{
@@ -125,7 +110,8 @@ static int parse_nal_unit(AVCodecParserContext *s,
AVCodecContext *avctx,
while (bytestream2_get_bytes_left(&gbc) > 1) {
GetBitContext gb;
- int payload_size_type, payload_type, payload_size;
+ uint64_t payload_size;
+ int payload_size_type, payload_type;
int block_size;
init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc));
@@ -138,6 +124,9 @@ static int parse_nal_unit(AVCodecParserContext *s,
AVCodecContext *avctx,
if (payload_size_type == 7)
payload_size = get_mb(&gb);
+ if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3))
+ return AVERROR_INVALIDDATA;
+
block_size = payload_size + (get_bits_count(&gb) >> 3);
if (block_size >= bytestream2_get_bytes_left(&gbc))
return AVERROR_INVALIDDATA;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
