diff --git a/common_video/h264/pps_parser.cc b/common_video/h264/pps_parser.cc index 8e52ec19cf..2fc9749e8c 100644 --- a/common_video/h264/pps_parser.cc +++ b/common_video/h264/pps_parser.cc @@ -11,6 +11,7 @@ #include "common_video/h264/pps_parser.h" #include +#include #include #include "absl/numeric/bits.h" @@ -116,7 +117,12 @@ absl::optional PpsParser::ParseInternal( // slice_group_id: array of size pic_size_in_map_units, each element // is represented by ceil(log2(num_slice_groups_minus1 + 1)) bits. - reader.ConsumeBits(slice_group_id_bits * pic_size_in_map_units); + int64_t bits_to_consume = + int64_t{slice_group_id_bits} * pic_size_in_map_units; + if (!reader.Ok() || bits_to_consume > std::numeric_limits::max()) { + return absl::nullopt; + } + reader.ConsumeBits(bits_to_consume); } } // num_ref_idx_l0_default_active_minus1: ue(v) diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index 171577aab7..27badf2d16 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -78,6 +78,7 @@ template("webrtc_fuzzer_test") { webrtc_fuzzer_test("h264_depacketizer_fuzzer") { sources = [ "h264_depacketizer_fuzzer.cc" ] deps = [ "../../modules/rtp_rtcp" ] + seed_corpus = "corpora/h264-depacketizer-fuzzer-corpus" } webrtc_fuzzer_test("vp8_depacketizer_fuzzer") { diff --git a/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 b/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 new file mode 100644 index 0000000000..dbe089f278 Binary files /dev/null and b/test/fuzzers/corpora/h264-depacketizer-fuzzer-corpus/h264-0 differ