[FFmpeg-devel] [PATCH 5/5] avformat/mov: Check if heif item name is already allocated

[James Almer]

On 4/26/2024 8:52 PM, Michael Niedermayer wrote:
> Fixes: memleak
> Fixes: 68212/clusterfuzz-testcase-minimized-ffmpeg_dem_MOV_fuzzer-4963488540721152
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/mov.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/libavformat/mov.c b/libavformat/mov.c
> index 97a24e6737e..5b8278f736e 100644
> --- a/libavformat/mov.c
> +++ b/libavformat/mov.c
> @@ -8136,6 +8136,9 @@ static int mov_read_infe(MOVContext *c, AVIOContext *pb, MOVAtom atom, int idx)
>       avio_rb24(pb);  // flags.
>       size -= 4;
>   
> +    if (c->heif_item[idx].name)
> +        return AVERROR_INVALIDDATA;

I prefer to free the old one before the av_bprint_finalize() call 
instead of aborting.

> +
>       if (version < 2) {
>           avpriv_report_missing_feature(c->fc, "infe version < 2");
>           return 1;