[FFmpeg-devel] [PATCH 3/3] avformat/mov: disallow a zero sample size in trun atoms

[Marton Balint]

On Tue, 28 Jun 2022, "zhilizhao(赵志立)" wrote:

>
>
>> On Jun 28, 2022, at 4:02 AM, Marton Balint <cus at passwd.hu> wrote:
>>
>> In order to not generate 0 sized packets or create a huge index table
>> needlessly.
>>
>> Fixes: Timeout
>> Fixes: 43717/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-5206008287330304
>> Fixes: 45738/clusterfuzz-testcase-minimized-ffmpeg_IO_DEMUXER_fuzzer-6142535657979904
>>
>> Signed-off-by: Marton Balint <cus at passwd.hu>
>> ---
>> libavformat/mov.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/libavformat/mov.c b/libavformat/mov.c
>> index c6fbe511c0..d7ef6ba6d6 100644
>> --- a/libavformat/mov.c
>> +++ b/libavformat/mov.c
>> @@ -5179,6 +5179,8 @@ static int mov_read_trun(MOVContext *c, AVIOContext *pb, MOVAtom atom)
>>         distance++;
>>         if (av_sat_add64(dts, sample_duration) != dts + (uint64_t)sample_duration)
>>             return AVERROR_INVALIDDATA;
>> +        if (!sample_size)
>> +            return AVERROR_INVALIDDATA;
>>         dts += sample_duration;
>>         offset += sample_size;
>>         sc->data_size += sample_size;
>
> LGTM.

Thanks, applied the series.

Regards,
Marton