This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 73681f888d avcodec/h264_parser: Check remaining input length in loop
in scan_mmco_reset()
73681f888d is described below
commit 73681f888da4705e33a9211cb31c2a5ef4d6c85c
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Feb 6 22:05:06 2026 +0100
Commit: Michael Niedermayer <[email protected]>
CommitDate: Mon Feb 23 22:43:28 2026 +0100
avcodec/h264_parser: Check remaining input length in loop in
scan_mmco_reset()
Fixes: read of uninitialized memory
Fixes:
476177761/clusterfuzz-testcase-minimized-ffmpeg_dem_H264_fuzzer-6400884824408064
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/h264_parser.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavcodec/h264_parser.c b/libavcodec/h264_parser.c
index 040739a1d4..a217a0dfe4 100644
--- a/libavcodec/h264_parser.c
+++ b/libavcodec/h264_parser.c
@@ -225,6 +225,9 @@ static int scan_mmco_reset(AVCodecParserContext *s,
GetBitContext *gb,
if (get_bits1(gb)) { // adaptive_ref_pic_marking_mode_flag
int i;
for (i = 0; i < H264_MAX_MMCO_COUNT; i++) {
+ if (get_bits_left(gb) < 1)
+ return AVERROR_INVALIDDATA;
+
MMCOOpcode opcode = get_ue_golomb_31(gb);
if (opcode > (unsigned) MMCO_LONG) {
av_log(logctx, AV_LOG_ERROR,
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
