h2645parser: Catch overflows in AVC/HEVC NAL unit length calculations
Offset and size are stored as 32 bit guint and might overflow when adding the nal_length_size, so let's avoid that. For the size this would happen if the AVC/HEVC NAL unit size happens to be stored in 4 bytes and is 4294967292 or higher, which is likely corrupted data anyway. For the offset this is something for the caller of these functions to take care of but is unlikely to happen as it would require parsing on a >4GB buffer. Allowing these overflows causes all kinds of follow-up bugs in the h2645parse elements, ranging from infinite loops and memory leaks to potential memory corruptions. Part-of: <!2107>
parent
a7d9bf73
No related branches found
No related tags found
Pipeline #290042 waiting for manual action
Stage: build docker
Stage: preparation
Stage: build
Stage: test
Stage: integrate
Showing
- gst-libs/gst/codecparsers/gsth264parser.c 15 additions, 1 deletiongst-libs/gst/codecparsers/gsth264parser.c
- gst-libs/gst/codecparsers/gsth265parser.c 15 additions, 1 deletiongst-libs/gst/codecparsers/gsth265parser.c
- tests/check/libs/h264parser.c 60 additions, 0 deletionstests/check/libs/h264parser.c
- tests/check/libs/h265parser.c 60 additions, 0 deletionstests/check/libs/h265parser.c
Loading
Please register or sign in to comment