• Andreas Rheinhardt's avatar
    avcodec/h2645_parse: Only trim RBSP trailing padding if it exists · a217c147
    Andreas Rheinhardt authored
    It does not exist for NALUs for which the SODB is empty;
    it also does not exist for NALUs for which not even
    the complete header is present. The former category contains
    end of sequence and end of bitstream units. The latter category
    consists of one-byte HEVC units (the ordinary H.264 header is only
    one byte long).
    This commit therefore stops stripping RBSP trailing padding
    from the former type of unit and discards the latter type of unit
    altogether.
    
    This also fixes an assertion failure: Before this commit, a one-byte
    HEVC NALU from an ISOBMFF packet could pass all the checks in
    hevc_parse_nal_header() (because the first byte of the size field
    of the next unit is mistaken as containing the temporal_id);
    yet because the trailing padding bits were stripped, its actually
    had a size of less than eight bits; because h2645_parse.c uses
    the checked bitstream reader, the get_bits_count() of the GetBitContext
    is not 16 in this case; it is not even a multiple of eight
    and this can trigger an assert in ff_hevc_decode_nal_sei().
    
    Fixes: Assertion failure
    Fixes: 46662/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-4947860854013952
    Reviewed-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
    Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@outlook.com>
    a217c147
h2645_parse.c 17.2 KB