virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity

avformat/vqf: Check header_size

Browse Source 
Fixes: 15271/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5735262606327808
Fixes: signed integer overflow: -2147483648 - 8 cannot be represented in type 'int'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7c30ff3888)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-06-18 23:17:23 +02:00
parent 21e5569d7f
commit 1d8bef7a48
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavformat/vqf.c
View File

@ -107,6 +107,9 @@ static int vqf_read_header(AVFormatContext *s)
header_size = avio_rb32(s->pb); header_size = avio_rb32(s->pb);
if (header_size < 0)
return AVERROR_INVALIDDATA;
st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO;
st->codecpar->codec_id = AV_CODEC_ID_TWINVQ; st->codecpar->codec_id = AV_CODEC_ID_TWINVQ;
st->start_time = 0; st->start_time = 0;
@ -120,7 +123,7 @@ static int vqf_read_header(AVFormatContext *s)
len = avio_rb32(s->pb); len = avio_rb32(s->pb);
if ((unsigned) len > INT_MAX/2) { if ((unsigned) len > INT_MAX/2 || header_size < 8) {
av_log(s, AV_LOG_ERROR, "Malformed header\n"); av_log(s, AV_LOG_ERROR, "Malformed header\n");
return -1; return -1;
} }