[FFmpeg-devel] [PATCH 1/2] avutil/channel_layout: av_channel_layout_describe_bprint: Check for buffer end

[James Almer]

On 7/1/2022 4:25 PM, Michael Niedermayer wrote:
> Fixes: Timeout printing a billion channels
> Fixes: 48099/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6754782204788736
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavutil/channel_layout.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c
> index 21b70173b7..72969eff14 100644
> --- a/libavutil/channel_layout.c
> +++ b/libavutil/channel_layout.c
> @@ -757,6 +757,10 @@ int av_channel_layout_describe_bprint(const AVChannelLayout *channel_layout,
>               if (channel_layout->order == AV_CHANNEL_ORDER_CUSTOM &&
>                   channel_layout->u.map[i].name[0])
>                   av_bprintf(bp, "@%s", channel_layout->u.map[i].name);
> +
> +            if (!av_bprint_is_complete(bp))
> +                return AVERROR(EINVAL);

Should be ENOMEM.

LGTM with that change.

> +
>           }
>           if (channel_layout->nb_channels) {
>               av_bprintf(bp, ")");