Eyevinn / mp4ff / 32371616985

82%

Build Type

push

github

Committed by tobbee

Commit Message

fix: bound more parameter counts read from bitstreams and boxes

Three more places size an allocation, or drive an append loop, from a count taken straight from attacker-controlled input, in the same way as num_ref_frames_in_pic_order_cnt_cycle did:

- avc num_slice_groups_minus1 (max 7 for any profile per Annex A) drives the
  run_length/top_left/slice_group_id append loops: a 7-byte PPS NAL unit
  allocated 10.4 GiB.
- hevc vps_num_hrd_parameters sizes a slice and allocates HRD parameters per
  iteration: a 33-byte VPS NAL unit churned 30 GiB. Its spec bound is
  vps_num_layer_sets_minus1 + 1, so bound that field to its own 0-1023 range
  first, which also stops the layer_id_included_flag loop from spinning.
- the alst sample group entry computes its optional entry count as a uint32
  subtraction that underflows when roll_count implies more bytes than
  description_length: a 32-byte sgpd box allocated 4 GiB.

Bound each count against its spec range before allocating, matching the style
of the existing checks in hevc/sps.go. The added tests use magnitudes that
fail the assertion cheaply if a check is removed, rather than exhausting
memory on the test runner.

Coverage Stats

18 of 19 new or added lines in 3 files covered. (94.74%)

1 existing line in 1 file now uncovered.

20718 of 25426 relevant lines covered (81.48%)

0.82 hits per line