[FFmpeg-devel] [PATCH 3/5] avformat/aaxdec: Check avio_seek() in inner loop for failure

[Michael Niedermayer]

On Tue, Apr 13, 2021 at 01:09:52PM -0300, James Almer wrote:
> On 4/13/2021 12:45 PM, Michael Niedermayer wrote:
> > Fixes: Timeout
> > Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008
> > 
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> > ---
> >   libavformat/aaxdec.c | 5 ++++-
> >   1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/libavformat/aaxdec.c b/libavformat/aaxdec.c
> > index c6d2d1c8d1..ff9768efac 100644
> > --- a/libavformat/aaxdec.c
> > +++ b/libavformat/aaxdec.c
> > @@ -249,7 +249,10 @@ static int aax_read_header(AVFormatContext *s)
> >                   goto fail;
> >               }
> > -            avio_seek(pb, data_offset, SEEK_SET);
> > +            ret = avio_seek(pb, data_offset, SEEK_SET);
> 
> There's another unchecked seek, and for both you should use an int64_t
> variable to store the return value, otherwise values > INT_MAX could be
> misinterpreted as errors.

There are 3 other unchecked seeks in the function, and 2 outside.
do you want me to add checks to all ?
we tend not to check avio_seek() unless its needed

i chanegd the code locally to use 64bit

Thanks

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have often repented speaking, but never of holding my tongue.
-- Xenocrates
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210414/7b456dcc/attachment.sig>