[FFmpeg-devel] [PATCH 1/7] avformat/vivo: Do not use the general expression evaluator for parsing a floating point value

[Marvin Scholz]

On 5 Dec 2021, at 22:19, Michael Niedermayer wrote:

> Fixes: Timeout
> Fixes: 
> 41564/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVO_fuzzer-6309014024093696
>
> Found-by: continuous fuzzing process 
> https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavformat/vivo.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/libavformat/vivo.c b/libavformat/vivo.c
> index b2904cd25a7..8e819d910b7 100644
> --- a/libavformat/vivo.c
> +++ b/libavformat/vivo.c
> @@ -206,11 +206,12 @@ static int vivo_read_header(AVFormatContext *s)
>                      return AVERROR_INVALIDDATA;
>                  value_used = 1;
>              } else if (!strcmp(key, "FPS")) {
> -                AVRational tmp;
> +                double d;
> +                if (sscanf(value, "%f", &d) != 1)
> +                    return AVERROR_INVALIDDATA;
>

Shouldn't this use av_sscanf, so it's not locale dependent?

>                  value_used = 1;
> -                if (!av_parse_ratio(&tmp, value, 10000, 
> AV_LOG_WARNING, s))
> -                    fps = av_inv_q(tmp);
> +                fps = av_d2q(1/d, 10000);
>              }
>
>              if (!value_used)
> -- 
> 2.17.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".