From be9ba46370b9ba4159220c817389649bd4f0027a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 9 Nov 2020 20:42:56 +0100 Subject: [PATCH] avformat/dhav: Break out of infinite dhav search loop Fixes: Infinite loop Fixes: 26922/clusterfuzz-testcase-minimized-ffmpeg_dem_DHAV_fuzzer-5794549613723648 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 7540d60bf687ae1f18927c5e6c3dbd317df9f35e) Signed-off-by: Michael Niedermayer --- libavformat/dhav.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/dhav.c b/libavformat/dhav.c index faaa1f6177..91c175498c 100644 --- a/libavformat/dhav.c +++ b/libavformat/dhav.c @@ -290,6 +290,8 @@ static int dhav_read_header(AVFormatContext *s) int seek_back; seek_back = avio_rl32(s->pb) + 8; + if (seek_back < 9) + break; dhav->last_good_pos = avio_tell(s->pb); avio_seek(s->pb, -seek_back, SEEK_CUR); }