virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-03-17 20:17:55 +02:00
Code Issues Releases Activity

avformat/matroskadec: Fix infinite loop with bz decompression

Browse Source 
The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c3d2cbb510674226b0c8fa6b146bf891f83786c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-02-03 22:46:55 +01:00
parent e42732b91f
commit 0027251644
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/matroskadec.c
View File

@ -1393,7 +1393,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
case MATROSKA_TRACK_ENCODING_COMP_ZLIB:
{
z_stream zstream = { 0 };
if (inflateInit(&zstream) != Z_OK)
if (!pkt_size || inflateInit(&zstream) != Z_OK)
return -1;
zstream.next_in = data;
zstream.avail_in = isize;
@ -1426,7 +1426,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
{
bz_stream bzstream = { 0 };
if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
if (!pkt_size || BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
return -1;
bzstream.next_in = data;
bzstream.avail_in = isize;