Eyevinn / mp4ff

83%

master: 82%

LAST BUILD ON BRANCH fix-sps-num-ref-frames-overflow

branch: fix-sps-num-ref-frames-overflow

CHANGE BRANCH

x

Reset

• fix-sps-num-ref-frames-overflow
• aac-asc-header
• av1-crypto-rap
• av1-update
• avcc-encode-trailing-info
• avcc-preserve-trailing-bytes
• avs3
• chore-bump-min-go-1.18
• chore-bump-min-go-1.19
• chore/prepare-v0.53.0
• chore/prepare-v0.56.0
• chore/remove-goreportcard-badge
• ci/checkout-v7
• codespell
• colr-icc-decode
• compressorname-length-clamp
• dac4
• decode-box-body-sr
• defragment-core
• defragment-hybrid
• defragment-overlaps
• docs/changelog-dec3-joc
• docs/install-instructions
• elst-media-rate
• esds-vocabulary
• feat-coll-box
• feat-create-sei-nalu
• feat-hevc-encrypt
• feat-ivf
• feat-lbli-sample-group
• feat-lhvc-box
• feat-linf-oinf-sample-groups
• feat-mvhevc-builders
• feat-mvhevc-cli
• feat-trgr-track-group
• feat-vexu-spatial-video
• feat-vp-codec-sample-box
• feat-vps-multilayer-extension
• feat/av1-metadata-obu-cea608
• feat/dolby-vision-dvh1-dvhe
• feat/hevc-hdr-boxes
• feat/motion-jpeg
• feat/mov-decoder
• feat/piff
• feat/stream-read-mdat-data
• feature-encryption-boxes
• feature/exporttfhd
• fix-avcdecoderconfig
• fix-bound-more-bitstream-counts
• fix-co64-size-overflow
• fix-goreleaser-brew
• fix-hevc-ps-dos
• fix-interleaved-sidx-boxes
• fix-mime-box
• fix-senc-panic
• fix-senc-robustness
• fix-short-esds-issue-393
• fix-sliceheader-spsid
• fix-ssix-box
• fix-stsc
• fix-subs-box
• fix-trailing-avc1-bytes
• fix-typos
• fix-vps-ols0-necessary-layers
• fix/cenc-encrypt-conformance
• fix/cenc-increment
• fix/hevc-slice-deblocking-inference
• fix/sei-nalu-short-panic
• flac
• fuzz-box
• go-releaser
• golangci-lint-v2
• handle-trailing-avc1-bytes
• hevc-vps
• iMro0t-feature-encryption-boxes
• iMro0t-fix-avcdecoderconfig
• improve-av1
• improved-crypt-tools
• issue-492
• labl-box
• lpcm-format-flags
• master
• mdat-header-size
• mdhd-dur-info
• minimal-ac4
• more-robust-decode
• mp4-blackbox-test
• mpeg-h
• new-pssh-func
• normalize-quicktime
• opus
• parse-joc-dolby-atmos
• patch-1
• qt-legacy-audio-entries
• qt-sound-descriptions
• release/v0.51.0
• release/v0.52.0
• release/v0.54.0
• release/v0.55.0
• remove-homebrew-cask
• return-partial-files
• sampleflags-test
• sei-recovery-point
• spherical-v1-no-xml
• sphericalv1
• stream-process
• test-header-parsing
• test-visualsampleentry
• tkhd-preserve-matrix
• update-changelog
• update-coverage-job
• update-docs
• update-make
• v0.48.0
• v0.49.0
• v0.50.0
• vtpl1-master
• vvc
• vvc-nal-headers
• wave-box
• wave-box-followups
• weird-dac3

Build # 32113058459

Build Type

Pull #550

github

Committed by ChrisJr404

Commit Message

fix: bound num_ref_frames_in_pic_order_cnt_cycle in AVC SPS parsing

An out-of-range num_ref_frames_in_pic_order_cnt_cycle was used directly to
size a slice, so a tiny malformed SPS NAL unit could make ParseSPSNALUnit
allocate multiple gigabytes. Reject values outside the spec range 0-255
(ISO/IEC 14496-10 7.4.2.1.1) before allocating.

Pull Request Pull Request #550: fix: bound num_ref_frames_in_pic_order_cnt_cycle in AVC SPS parsing

Coverage Stats

7 of 7 new or added lines in 1 file covered. (100.0%)

23968 of 28946 relevant lines covered (82.8%)

0.92 hits per line