Fuzzer fixes #37
Open
Fuzzer fixes #37
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Since pps_buf[...] might be allocated here already, prevent a memory leak by calling realloc instead of malloc.
The value is being overwritten instead of or'd, which appears to be the intention.
We're allocating and then checking to see if there are enough arguments. This causes valgrind to report a memory leak, even if it doesn't matter; therefore, just fix.
This function was not always checking to see buf[i+x] was inside the buffer before reading the memory. Now it does.
In one error path, `b` and `rbsp_buf` were being leaked. It's worth noting that this was fixed in read_nal_unit.
…set_table There are a bunch of array writes that take their index from the bitstream but do not check to make sure the index is in-bound. In many of these cases, you'd expect the extra values to exist in the stream, so we still must read them. When fuzzing h256_analize with AFL++, these missing bounds checks frequently cause segfaults & other issues. Tied up in this, there is definitely a double free wrt sps_subset_table & sps_subset, since the existing code was memcpy'ing pointers to arrays between structures. This code copies the contents of the arrays instead.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See Issue #36.