Skip to content

Commit 2023bf1

Browse files
authored
fix panic when checking pts = dts on H265 (bluenviron/mediamtx#3754) (#617)
1 parent cb3c527 commit 2023bf1

21 files changed

+56
-4
lines changed

pkg/format/h264_test.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,9 @@ func FuzzUnmarshalH264(f *testing.F) {
8787
}
8888
})
8989
}
90+
91+
func FuzzH264PTSEqualsDTS(f *testing.F) {
92+
f.Fuzz(func(t *testing.T, b []byte) {
93+
(&H264{}).PTSEqualsDTS(&rtp.Packet{Payload: b})
94+
})
95+
}

pkg/format/h265.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,13 +140,13 @@ func (f *H265) PTSEqualsDTS(pkt *rtp.Packet) bool {
140140
return true
141141

142142
case h265.NALUType_AggregationUnit:
143+
if len(pkt.Payload) < 4 {
144+
return false
145+
}
146+
143147
payload := pkt.Payload[2:]
144148

145149
for {
146-
if len(payload) < 2 {
147-
return false
148-
}
149-
150150
size := uint16(payload[0])<<8 | uint16(payload[1])
151151
payload = payload[2:]
152152

@@ -167,6 +167,10 @@ func (f *H265) PTSEqualsDTS(pkt *rtp.Packet) bool {
167167
if len(payload) == 0 {
168168
break
169169
}
170+
171+
if len(payload) < 2 {
172+
return false
173+
}
170174
}
171175

172176
case h265.NALUType_FragmentationUnit:

pkg/format/h265_test.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,9 @@ func FuzzUnmarshalH265(f *testing.F) {
104104
}
105105
})
106106
}
107+
108+
func FuzzH265PTSEqualsDTS(f *testing.F) {
109+
f.Fuzz(func(t *testing.T, b []byte) {
110+
(&H265{}).PTSEqualsDTS(&rtp.Packet{Payload: b})
111+
})
112+
}
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("800")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("\xbc")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("8")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("\xbc\xa8")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("\xbc0")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("8\x00\x010")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("8\x00\x01%")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("A")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("b0\xd3")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a0")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a0\x00\x040000")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("b00")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a0\x00\x04A000")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a000")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("a0\x00\x0100")
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
go test fuzz v1
2+
[]byte("b0")

0 commit comments

Comments
 (0)