Eyevinn / mp4ff / 37210364673

83%

push

github

fix(avc): bound cpb_cnt_minus1 in SPS VUI HRD parameters

parseHrdParameters looped cpb_cnt_minus1 + 1 times, appending a CpbEntry
each time, without checking the value. A bogus value from a 22-byte SPS
made ParseSPSNALUnit (with parseVUIBeyondAspectRatio set) allocate until
memory ran out, or loop forever for 2^64-1. Values above 31 (ISO/IEC
14496-10 E.2.2) are now rejected.

Found by fuzzing the avc functions that hi264 uses, seeded with its golden
streams. A further 22 million executions with the fix found nothing more.

4 of 4 new or added lines in 1 file covered. (100.0%)

23249 of 28143 relevant lines covered (82.61%)

0.83 hits per line