virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avformat/iff: More completely check body_size

Browse Source 
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 3588e2e6b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-10-21 22:56:17 +02:00
parent 48fbee3b44
commit e03a2c7106
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/iff.c
View File

@ -837,7 +837,7 @@ static int iff_read_packet(AVFormatContext *s,
} else if (st->codecpar->codec_tag == ID_DST) { } else if (st->codecpar->codec_tag == ID_DST) {
return read_dst_frame(s, pkt); return read_dst_frame(s, pkt);
} else { } else {
if (iff->body_size > INT_MAX) if (iff->body_size > INT_MAX || !iff->body_size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, iff->body_size); ret = av_get_packet(pb, pkt, iff->body_size);
} }
@ -873,6 +873,8 @@ static int iff_read_packet(AVFormatContext *s,
pkt->flags |= AV_PKT_FLAG_KEY; pkt->flags |= AV_PKT_FLAG_KEY;
} else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && } else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO &&
st->codecpar->codec_tag != ID_ANIM) { st->codecpar->codec_tag != ID_ANIM) {
if (iff->body_size > INT_MAX || !iff->body_size)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, iff->body_size); ret = av_get_packet(pb, pkt, iff->body_size);
pkt->pos = pos; pkt->pos = pos;
if (pos == iff->body_pos) if (pos == iff->body_pos)