PR #25701 opened by kierank URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25701 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25701.patch
hls_slice_data_wpp() added up the rows' return values: 0, the end ctb_addr_ts of the picture (last row only) or an error. When two or more rows fail on corrupt input, adding AVERROR_INVALIDDATA values overflows int, which is undefined behaviour, and the wrapped result can be positive, so the error was lost. Return the first error, as hls_slice_data_tiles() does. Found by fuzzing conformance streams with byte corruption, e.g. WPP_A_ericsson_MAIN_2 at -threads 8 -thread_type slice. Found and written with AI >From f0c2407a9872bee7eb42d80c31d3ac46a81ac387 Mon Sep 17 00:00:00 2001 From: Kieran Kunhya <[email protected]> Date: Tue, 3 Nov 2026 01:49:51 +0100 Subject: [PATCH] avcodec/hevc/hevcdec: return the first WPP row error instead of the sum hls_slice_data_wpp() added up the rows' return values: 0, the end ctb_addr_ts of the picture (last row only) or an error. When two or more rows fail on corrupt input, adding AVERROR_INVALIDDATA values overflows int, which is undefined behaviour, and the wrapped result can be positive, so the error was lost. Return the first error, as hls_slice_data_tiles() does. Found by fuzzing conformance streams with byte corruption, e.g. WPP_A_ericsson_MAIN_2 at -threads 8 -thread_type slice. --- libavcodec/hevc/hevcdec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavcodec/hevc/hevcdec.c b/libavcodec/hevc/hevcdec.c index f1bd5622913..d7743fe1f0c 100644 --- a/libavcodec/hevc/hevcdec.c +++ b/libavcodec/hevc/hevcdec.c @@ -3068,8 +3068,13 @@ static int hls_slice_data_wpp(HEVCContext *s, const H2645NAL *nal) if (pps->entropy_coding_sync_enabled_flag) s->avctx->execute2(s->avctx, hls_decode_entry_wpp, s->local_ctx, ret, s->sh.num_entry_point_offsets + 1); - for (int i = 0; i <= s->sh.num_entry_point_offsets; i++) + for (int i = 0; i <= s->sh.num_entry_point_offsets; i++) { + if (ret[i] < 0) { + res = ret[i]; + break; + } res += ret[i]; + } av_free(ret); return res; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
