virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

avformat/oggdec: Do not hardcode arbitrary and sometimes unavailable size

Browse Source 
Fixes: regression since e983197cbc93420b67aa7e811be47d7278c2c8a2
Fixes: out of array read
Fixes: 22185/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5662069073641472

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Lynne <dev@lynne.ee>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-06 19:30:30 +02:00
parent 108ee4b4a5
commit 8edfd0598d
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavformat/oggdec.c
View File

@ -206,7 +206,7 @@ static const struct ogg_codec *ogg_find_codec(uint8_t *buf, int size)
* situation where a new audio stream spawn (identified with a new serial) and * situation where a new audio stream spawn (identified with a new serial) and
* must replace the previous one (track switch). * must replace the previous one (track switch).
*/ */
static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic, int page_size,
int probing) int probing)
{ {
struct ogg *ogg = s->priv_data; struct ogg *ogg = s->priv_data;
@ -220,7 +220,7 @@ static int ogg_replace_stream(AVFormatContext *s, uint32_t serial, char *magic,
} }
/* Check for codecs */ /* Check for codecs */
codec = ogg_find_codec(magic, 8); codec = ogg_find_codec(magic, page_size);
if (!codec && !probing) { if (!codec && !probing) {
av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n"); av_log(s, AV_LOG_ERROR, "Cannot identify new stream\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -430,7 +430,7 @@ static int ogg_read_page(AVFormatContext *s, int *sid, int probing)
/* CRC is correct so we can be 99% sure there's an actual change here */ /* CRC is correct so we can be 99% sure there's an actual change here */
if (idx < 0) { if (idx < 0) {
if (data_packets_seen(ogg)) if (data_packets_seen(ogg))
idx = ogg_replace_stream(s, serial, readout_buf, probing); idx = ogg_replace_stream(s, serial, readout_buf, size, probing);
else else
idx = ogg_new_stream(s, serial); idx = ogg_new_stream(s, serial);