virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-03-28 12:32:17 +02:00
Code Issues Releases Activity

avformat/matroskadec: Fix infinite loop with bz decompression

Browse Source 
The same check is added to zlib too, it seems not needed there though

Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-02-03 22:46:55 +01:00
parent 948c262099
commit 9c3d2cbb51
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/matroskadec.c
View File

@ -1709,7 +1709,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
case MATROSKA_TRACK_ENCODING_COMP_ZLIB: case MATROSKA_TRACK_ENCODING_COMP_ZLIB:
{ {
z_stream zstream = { 0 }; z_stream zstream = { 0 };
if (inflateInit(&zstream) != Z_OK) if (!pkt_size || inflateInit(&zstream) != Z_OK)
return -1; return -1;
zstream.next_in = data; zstream.next_in = data;
zstream.avail_in = isize; zstream.avail_in = isize;
@ -1742,7 +1742,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
case MATROSKA_TRACK_ENCODING_COMP_BZLIB: case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
{ {
bz_stream bzstream = { 0 }; bz_stream bzstream = { 0 };
if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK) if (!pkt_size || BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
return -1; return -1;
bzstream.next_in = data; bzstream.next_in = data;
bzstream.avail_in = isize; bzstream.avail_in = isize;