virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avformat/vividas: Check n_sb_blocks against input space

Browse Source 
Fixes: OOM
Fixes: 16726/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5719320750981120

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-09-04 16:18:35 +02:00
parent cede385018
commit 8e51f35f81
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavformat/vividas.c
View File

@ -422,7 +422,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *
return 0;
}
static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size)
static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size)
{
int64_t off;
int64_t poff;
@ -432,16 +432,21 @@ static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *b
pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL);
if (!pb)
return;
return AVERROR(ENOMEM);
ffio_read_varlen(pb); // track_index_len
avio_r8(pb); // 'c'
viv->n_sb_blocks = ffio_read_varlen(pb);
if (viv->n_sb_blocks * 2 > size) {
viv->n_sb_blocks = 0;
av_free(pb);
return AVERROR_INVALIDDATA;
}
viv->sb_blocks = av_calloc(viv->n_sb_blocks, sizeof(VIV_SB_block));
if (!viv->sb_blocks) {
viv->n_sb_blocks = 0;
av_free(pb);
return;
return AVERROR(ENOMEM);
}
off = 0;
@ -464,6 +469,8 @@ static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *b
viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry));
av_free(pb);
return 0;
}
static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size)
@ -589,8 +596,10 @@ static int viv_read_header(AVFormatContext *s)
buf = read_vblock(pb, &v, key, &k2, v);
if (!buf)
return AVERROR(EIO);
track_index(viv, s, buf, v);
ret = track_index(viv, s, buf, v);
av_free(buf);
if (ret < 0)
return ret;
viv->sb_offset = avio_tell(pb);
if (viv->n_sb_blocks > 0) {