This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.1 in repository ffmpeg.
commit b013bbf092a5b7f2be4cf89292372c56ebb1c072 Author: James Almer <[email protected]> AuthorDate: Sun Mar 8 21:07:55 2026 -0300 Commit: James Almer <[email protected]> CommitDate: Fri Mar 13 09:06:53 2026 -0300 avcodec/lcevc_parser: Check that block_size is not negative Based on 248b481c337d917e0fece9555ae59b5375c725c6 Signed-off-by: James Almer <[email protected]> (cherry picked from commit 125bb2e045fda63701a0d7ec0464129d18210617) --- libavcodec/bsf/extract_extradata.c | 17 +------------- libavcodec/{x86/g722dsp_init.c => lcevc_parse.h} | 29 +++++++++++++++--------- libavcodec/lcevc_parser.c | 23 +++++-------------- 3 files changed, 25 insertions(+), 44 deletions(-) diff --git a/libavcodec/bsf/extract_extradata.c b/libavcodec/bsf/extract_extradata.c index 5dd13013bc..1532eb6a7d 100644 --- a/libavcodec/bsf/extract_extradata.c +++ b/libavcodec/bsf/extract_extradata.c @@ -30,6 +30,7 @@ #include "h2645_parse.h" #include "h264.h" #include "lcevc.h" +#include "lcevc_parse.h" #include "startcode.h" #include "vc1_common.h" #include "vvc.h" @@ -268,22 +269,6 @@ static int extract_extradata_h2645(AVBSFContext *ctx, AVPacket *pkt, return 0; } -static inline uint64_t get_mb(GetBitContext *s) { - int more, i = 0; - uint64_t mb = 0; - - do { - int byte = get_bits(s, 8); - unsigned bits = byte & 0x7f; - more = byte & 0x80; - mb = (mb << 7) | bits; - if (++i == 10) - break; - } while (more); - - return mb; -} - /** * Rewrite the NALu stripping the unneeded blocks. * Given that length fields coded inside the NALu are not aware of any emulation_3bytes diff --git a/libavcodec/x86/g722dsp_init.c b/libavcodec/lcevc_parse.h similarity index 64% copy from libavcodec/x86/g722dsp_init.c copy to libavcodec/lcevc_parse.h index 614695193b..f56758a1a5 100644 --- a/libavcodec/x86/g722dsp_init.c +++ b/libavcodec/lcevc_parse.h @@ -1,6 +1,4 @@ /* - * Copyright (c) 2014 James Almer - * * This file is part of FFmpeg. * * FFmpeg is free software; you can redistribute it and/or @@ -18,18 +16,27 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +#ifndef AVCODEC_LCEVC_PARSE_H +#define AVCODEC_LCEVC_PARSE_H + #include <stdint.h> -#include "libavutil/attributes.h" -#include "libavutil/x86/cpu.h" -#include "libavcodec/g722dsp.h" +#include "get_bits.h" -void ff_g722_apply_qmf_sse2(const int16_t *prev_samples, int xout[2]); +static inline uint64_t get_mb(GetBitContext *s) { + int more, i = 0; + uint64_t mb = 0; -av_cold void ff_g722dsp_init_x86(G722DSPContext *dsp) -{ - int cpu_flags = av_get_cpu_flags(); + do { + int byte = get_bits(s, 8); + unsigned bits = byte & 0x7f; + more = byte & 0x80; + mb = (mb << 7) | bits; + if (++i == 10) + break; + } while (more); - if (EXTERNAL_SSE2(cpu_flags)) - dsp->apply_qmf = ff_g722_apply_qmf_sse2; + return mb; } + +#endif /* AVCODEC_LCEVC_PARSE_H */ diff --git a/libavcodec/lcevc_parser.c b/libavcodec/lcevc_parser.c index 77888a3efc..f3338c4659 100644 --- a/libavcodec/lcevc_parser.c +++ b/libavcodec/lcevc_parser.c @@ -25,6 +25,7 @@ #include "get_bits.h" #include "h2645_parse.h" #include "lcevc.h" +#include "lcevc_parse.h" #include "parser.h" #include "parser_internal.h" @@ -100,22 +101,6 @@ static const struct { { 7680, 4800 }, }; -static inline uint64_t get_mb(GetBitContext *s) { - int more, i = 0; - uint64_t mb = 0; - - do { - int byte = get_bits(s, 8); - unsigned bits = byte & 0x7f; - more = byte & 0x80; - mb = (mb << 7) | bits; - if (++i == 10) - break; - } while (more); - - return mb; -} - static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, const H2645NAL *nal) { @@ -125,7 +110,8 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, while (bytestream2_get_bytes_left(&gbc) > 1) { GetBitContext gb; - int payload_size_type, payload_type, payload_size; + uint64_t payload_size; + int payload_size_type, payload_type; int block_size; init_get_bits8(&gb, gbc.buffer, bytestream2_get_bytes_left(&gbc)); @@ -138,6 +124,9 @@ static int parse_nal_unit(AVCodecParserContext *s, AVCodecContext *avctx, if (payload_size_type == 7) payload_size = get_mb(&gb); + if (payload_size > INT_MAX - (get_bits_count(&gb) >> 3)) + return AVERROR_INVALIDDATA; + block_size = payload_size + (get_bits_count(&gb) >> 3); if (block_size >= bytestream2_get_bytes_left(&gbc)) return AVERROR_INVALIDDATA; _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
