Eyevinn / mp4ff / 28661241724

82%

push

github

hevc: bound parameter-set parser loops on malformed input (DoS fix)

Several loops in the HEVC SPS/PPS parsers iterate over a count read from the
bitstream (ue(v)/u(n)) without checking the reader's accumulated error. On a
truncated or malformed NAL, EBSPReader.Read returns 0 past end-of-data and sets
its accumulated error, but these loops kept iterating over the (potentially
~2^32) count — effectively hanging and growing unbounded slices. A malformed
parameter set is thus a denial-of-service vector for any caller parsing
untrusted input.

Fixes:
- Add `&& r.AccError() == nil` to every bitstream-count-bounded loop in pps.go
  (tile columns/rows, chroma-QP-offset list, ref-loc offsets, colour-mapping
  ref layers, colour-mapping octants, palette predictor initializers, 3D
  delta-DLT) and sps.go (SCC palette predictor initializers), so parsing stops
  at end-of-data.
- Don't pre-size the RefLocOffsets map from the bitstream-derived count
  (make(map, hugeN) would attempt an enormous allocation); let it grow.

Valid streams are unaffected (they never hit EOF mid-parameter-set). Adds
regression tests (ps_dos_test.go) with fuzz-discovered inputs that hang without
the fix and return promptly with it, plus fuzz targets (ps_fuzz_test.go) and
seed corpus. All existing tests still pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

8 of 14 new or added lines in 2 files covered. (57.14%)

21511 of 25765 relevant lines covered (83.49%)

0.93 hits per line