virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

avcodec/mpeg4videodec: Check for multiple VOL headers

Browse Source 
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efeb47fd5d5cbf980e52a6d5e741c3c74b94b5e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2017-05-21 16:01:27 +02:00
parent d11c686204
commit a7442f8d35
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mpeg4videodec.c
View File

@ -2566,6 +2566,7 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)
MpegEncContext *s = &ctx->m; MpegEncContext *s = &ctx->m;
unsigned startcode, v; unsigned startcode, v;
int ret; int ret;
int vol = 0;
/* search next start code */ /* search next start code */
align_get_bits(gb); align_get_bits(gb);
@ -2654,6 +2655,11 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb)
} }
if (startcode >= 0x120 && startcode <= 0x12F) { if (startcode >= 0x120 && startcode <= 0x12F) {
if (vol) {
av_log(s->avctx, AV_LOG_ERROR, "Multiple VOL headers");
return AVERROR_INVALIDDATA;
}
vol++;
if ((ret = decode_vol_header(ctx, gb)) < 0) if ((ret = decode_vol_header(ctx, gb)) < 0)
return ret; return ret;
} else if (startcode == USER_DATA_STARTCODE) { } else if (startcode == USER_DATA_STARTCODE) {