FFmpeg/libavcodec/hevc
Michael Niedermayer 791a333a0e
avcodec/hevc/hevcdec: Check num_entry_point_offsets
The code uses int, unsigned int and uint16_t to store num_entry_point_offsets
This limits it to the smallest of the 3.
Alternatively uint16_t can be changed and then a larger limit used.
A Check will still be needed.

Fixes: 391974932/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5966648879677440
Fixes: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2025-05-30 22:07:09 +02:00
..
cabac.c
data.c
data.h
dsp.c
dsp.h
dsp_template.c
filter.c
hevc.h
hevcdec.c avcodec/hevc/hevcdec: Check num_entry_point_offsets 2025-05-30 22:07:09 +02:00
hevcdec.h
Makefile
mvs.c
parse.c
parse.h
parser.c
pred.c
pred.h
pred_template.c
ps.c avcodec/hevc/ps: Fix dependant layer id check 2025-05-09 22:27:04 +02:00
ps.h
ps_enc.c
refs.c avcodec/decode: Only use ff_progress_frame_get_buffer() with blank input 2025-04-14 10:15:08 +02:00
sei.c
sei.h