[FFmpeg-cvslog] avformat/aaxdec: Check avio_seek() in header reading

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Mon Apr 12 21:21:08 2021 +0200| [5f891809d774a41d2d492a120b7f1ebb6f7e6276] | committer: Michael Niedermayer

avformat/aaxdec: Check avio_seek() in header reading

Fixes: Timeout
Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 602bbf71f683dc564822c39070c42246d2c2b5e2)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5f891809d774a41d2d492a120b7f1ebb6f7e6276
---

 libavformat/aaxdec.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c
index c6d2d1c8d1..e69e5615ee 100644
--- a/libavformat/aaxdec.c
+++ b/libavformat/aaxdec.c
@@ -117,6 +117,7 @@ static int aax_read_header(AVFormatContext *s)
     int64_t column_offset = 0;
     int ret, extradata_size;
     char *codec;
+    int64_t ret64;
 
     avio_skip(pb, 4);
     a->table_size      = avio_rb32(pb) + 8LL;
@@ -218,7 +219,10 @@ static int aax_read_header(AVFormatContext *s)
         }
     }
 
-    avio_seek(pb, a->strings_offset, SEEK_SET);
+    ret = ret64 = avio_seek(pb, a->strings_offset, SEEK_SET);
+    if (ret64 < 0)
+        goto fail;
+
     ret = avio_read(pb, a->string_table, a->strings_size);
     if (ret != a->strings_size) {
         if (ret < 0)
@@ -249,7 +253,10 @@ static int aax_read_header(AVFormatContext *s)
                 goto fail;
             }
 
-            avio_seek(pb, data_offset, SEEK_SET);
+            ret = ret64 = avio_seek(pb, data_offset, SEEK_SET);
+            if (ret64 < 0)
+                goto fail;
+
             if (type == COLUMN_TYPE_VLDATA) {
                 int64_t start, size;
 
@@ -281,8 +288,8 @@ static int aax_read_header(AVFormatContext *s)
     codec = a->string_table + a->name_offset;
     if (!strcmp(codec, "AAX")) {
         par->codec_id = AV_CODEC_ID_ADPCM_ADX;
-        avio_seek(pb, a->segments[0].start, SEEK_SET);
-        if (avio_rb16(pb) != 0x8000) {
+        ret64 = avio_seek(pb, a->segments[0].start, SEEK_SET);
+        if (ret64 < 0 || avio_rb16(pb) != 0x8000) {
             ret = AVERROR_INVALIDDATA;
             goto fail;
         }