[FFmpeg-devel] [PATCH 4/5] avformat/mxfdec: Detect infinite loop of segments

[Michael Niedermayer]

Fixes: Infinite loop
Fixes: 371059874/clusterfuzz-testcase-minimized-ffmpeg_dem_MXF_fuzzer-5024314548617216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavformat/mxfdec.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
index 147b6a17f68..7a0731614c8 100644
--- a/libavformat/mxfdec.c
+++ b/libavformat/mxfdec.c
@@ -1908,6 +1908,7 @@ static int64_t mxf_essence_container_end(MXFContext *mxf, int body_sid)
 static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_table, int64_t edit_unit, AVRational edit_rate, int64_t *edit_unit_out, int64_t *offset_out, MXFPartition **partition_out, int nag)
 {
     int i = 0;
+    int lastdir = 0;
     int64_t index_duration, index_end;
     MXFIndexTableSegment *first_segment, *last_segment;
 
@@ -1969,12 +1970,14 @@ static int mxf_edit_unit_absolute_offset(MXFContext *mxf, MXFIndexTable *index_t
                 *edit_unit_out = av_rescale_q(edit_unit, edit_rate, s->index_edit_rate);
 
             return mxf_absolute_bodysid_offset(mxf, index_table->body_sid, offset_temp, offset_out, partition_out);
-        } else if (edit_unit < s->index_start_position) {
-            // the segments are sorted by IndexStartPosition, so this is guaranteed to terminate
-            i--;
         } else {
-            // edit_unit >= s->index_start_position + s->index_duration
-            i++;
+            // the segments are sorted by IndexStartPosition
+            int dir = (edit_unit < s->index_start_position) ? -1 : 1;
+
+            if (lastdir == -dir)
+                break;
+            i += dir;
+            lastdir = dir;
         }
     }
 
-- 
2.47.0