From 2e3f6afda52d599e70a5b0a29d4d22857054f32a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 14 Jun 2020 19:51:23 +0200
Subject: [PATCH] avformat/4xm: Check that a video stream was created before
returning packets for it
Fixes: assertion failure
Fixes: 23434/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5227750851084288.fuzz
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c517c3f4741b6897ea952d1fba199c93c5217cfe)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavformat/4xm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libavformat/4xm.c b/libavformat/4xm.c
index 39b30413cf..e93095cb09 100644
--- a/libavformat/4xm.c
+++ b/libavformat/4xm.c
@@ -218,6 +218,7 @@ static int fourxm_read_header(AVFormatContext *s)
fourxm->track_count = 0;
fourxm->tracks = NULL;
fourxm->fps = (AVRational){1,1};
+ fourxm->video_stream_index = -1;
/* skip the first 3 32-bit numbers */
avio_skip(pb, 12);
@@ -323,6 +324,8 @@ static int fourxm_read_packet(AVFormatContext *s,
case cfr2_TAG:
/* allocate 8 more bytes than 'size' to account for fourcc
* and size */
+ if (fourxm->video_stream_index < 0)
+ return AVERROR_INVALIDDATA;
if (size + 8 < size || av_new_packet(pkt, size + 8))
return AVERROR(EIO);
pkt->stream_index = fourxm->video_stream_index;