Eyevinn / mp4ff
83%
master: 83%

LAST BUILD BRANCH: improve-av1
DEFAULT BRANCH: master
Repo Added
Files 200
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix-hevc-ps-dos
branch: fix-hevc-ps-dos
CHANGE BRANCH
x

coverage: 83.489% (+0.3%) from 83.162%
28660937776

Pull #516

github

tobbee 
hevc: bound parameter-set parser loops on malformed input (DoS fix)

Several loops in the HEVC SPS/PPS parsers iterate over a count read from the
bitstream (ue(v)/u(n)) without checking the reader's accumulated error. On a
truncated or malformed NAL, EBSPReader.Read returns 0 past end-of-data and sets
its accumulated error, but these loops kept iterating over the (potentially
~2^32) count — effectively hanging and growing unbounded slices. A malformed
parameter set is thus a denial-of-service vector for any caller parsing
untrusted input.

Fixes:
- Add `&& r.AccError() == nil` to every bitstream-count-bounded loop in pps.go
  (tile columns/rows, chroma-QP-offset list, ref-loc offsets, colour-mapping
  ref layers, colour-mapping octants, palette predictor initializers, 3D
  delta-DLT) and sps.go (SCC palette predictor initializers), so parsing stops
  at end-of-data.
- Don't pre-size the RefLocOffsets map from the bitstream-derived count
  (make(map, hugeN) would attempt an enormous allocation); let it grow.

Valid streams are unaffected (they never hit EOF mid-parameter-set). Adds
regression tests (ps_dos_test.go) with fuzz-discovered inputs that hang without
the fix and return promptly with it, plus fuzz targets (ps_fuzz_test.go) and
seed corpus. All existing tests still pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pull Request #516: hevc: bound parameter-set parser loops on malformed input (DoS)

8 of 14 new or added lines in 2 files covered. (57.14%)

21511 of 25765 relevant lines covered (83.49%)

0.93 hits per line

Relevant lines Covered
25765 RELEVANT LINES 21511 COVERED LINES
0.93 HITS PER LINE
Source Files on fix-hevc-ps-dos

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
28660937776 fix-hevc-ps-dos hevc: bound parameter-set parser loops on malformed input (DoS fix) Several loops in the HEVC SPS/PPS parsers iterate over a count read from the bitstream (ue(v)/u(n)) without checking the reader's accumulated error. On a truncated or malformed N... Pull #516 tobbee github
83.49
28531845388 fix-hevc-ps-dos hevc: bound parameter-set parser loops on malformed input (DoS fix) Several loops in the HEVC SPS/PPS parsers iterate over a count read from the bitstream (ue(v)/u(n)) without checking the reader's accumulated error. On a truncated or malformed N... Pull #516 zshenker github
83.49
See All Builds (305)