[FFmpeg-cvslog] avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
Michael Niedermayer
git at videolan.org
Thu Feb 1 01:52:53 EET 2018
ffmpeg | branch: release/2.8 | Michael Niedermayer <michael at niedermayer.cc> | Fri Jan 5 22:12:07 2018 +0100| [c860d5326f566acf039400a1e80004cb3d5d6685] | committer: Michael Niedermayer
avcodec/opus_parser: Check payload_len in parse_opus_ts_header()
Fixes: clusterfuzz-testcase-minimized-6134545979277312
Fixes: crbug 797469
Reported-by: Matt Wolenetz <wolenetz at google.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 1bcd7fefcb3c1ec47978fdc64a9e8dfb9512ae62)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c860d5326f566acf039400a1e80004cb3d5d6685
---
libavcodec/opus_parser.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/libavcodec/opus_parser.c b/libavcodec/opus_parser.c
index c30fd7bbd4..1c61c0077f 100644
--- a/libavcodec/opus_parser.c
+++ b/libavcodec/opus_parser.c
@@ -43,6 +43,7 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
const uint8_t *buf = start + 1;
int start_trim_flag, end_trim_flag, control_extension_flag, control_extension_length;
uint8_t flags;
+ uint64_t payload_len_tmp;
GetByteContext gb;
bytestream2_init(&gb, buf, buf_len);
@@ -52,11 +53,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
end_trim_flag = (flags >> 3) & 1;
control_extension_flag = (flags >> 2) & 1;
- *payload_len = 0;
+ payload_len_tmp = *payload_len = 0;
while (bytestream2_peek_byte(&gb) == 0xff)
- *payload_len += bytestream2_get_byte(&gb);
+ payload_len_tmp += bytestream2_get_byte(&gb);
- *payload_len += bytestream2_get_byte(&gb);
+ payload_len_tmp += bytestream2_get_byte(&gb);
if (start_trim_flag)
bytestream2_skip(&gb, 2);
@@ -67,6 +68,11 @@ static const uint8_t *parse_opus_ts_header(const uint8_t *start, int *payload_le
bytestream2_skip(&gb, control_extension_length);
}
+ if (bytestream2_tell(&gb) + payload_len_tmp > buf_len)
+ return NULL;
+
+ *payload_len = payload_len_tmp;
+
return buf + bytestream2_tell(&gb);
}
@@ -104,6 +110,10 @@ static int opus_find_frame_end(AVCodecParserContext *ctx, AVCodecContext *avctx,
state = (state << 8) | payload[i];
if ((state & OPUS_TS_MASK) == OPUS_TS_HEADER) {
payload = parse_opus_ts_header(payload, &payload_len, buf_size - i);
+ if (!payload) {
+ av_log(avctx, AV_LOG_ERROR, "Error parsing Ogg TS header.\n");
+ return AVERROR_INVALIDDATA;
+ }
*header_len = payload - buf;
start_found = 1;
break;
More information about the ffmpeg-cvslog
mailing list