[FFmpeg-devel] [PATCH 8/9] avformat/iff: More completely check body_size
Michael Niedermayer
michael at niedermayer.cc
Thu Oct 22 01:37:32 EEST 2020
Fixes: infinite loop
Fixes: 26485/clusterfuzz-testcase-minimized-ffmpeg_dem_IFF_fuzzer-5126561373880320
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
libavformat/iff.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libavformat/iff.c b/libavformat/iff.c
index 04fe8be4eb..fb76aed4c3 100644
--- a/libavformat/iff.c
+++ b/libavformat/iff.c
@@ -839,7 +839,7 @@ static int iff_read_packet(AVFormatContext *s,
} else if (st->codecpar->codec_tag == ID_DST) {
return read_dst_frame(s, pkt);
} else {
- if (iff->body_size > INT_MAX)
+ if (iff->body_size > INT_MAX || !iff->body_size)
return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, iff->body_size);
}
@@ -875,6 +875,8 @@ static int iff_read_packet(AVFormatContext *s,
pkt->flags |= AV_PKT_FLAG_KEY;
} else if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO &&
st->codecpar->codec_tag != ID_ANIM) {
+ if (iff->body_size > INT_MAX || !iff->body_size)
+ return AVERROR_INVALIDDATA;
ret = av_get_packet(pb, pkt, iff->body_size);
pkt->pos = pos;
if (pos == iff->body_pos)
--
2.17.1
More information about the ffmpeg-devel
mailing list