[FFmpeg-devel] [PATCH 1/5] avformat/flvdec: Check for EOF in AudioPacketTypeMultichannelConfig

[Timo Rothenpieler]

On 7/13/2025 3:10 AM, Michael Niedermayer wrote:
> Fixes: Infinite loop
> Fixes: 427538726/clusterfuzz-testcase-minimized-ffmpeg_dem_FLV_fuzzer-6582567304495104
> 
> Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>   libavformat/flvdec.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c
> index ac681954cb7..a4fa0157512 100644
> --- a/libavformat/flvdec.c
> +++ b/libavformat/flvdec.c
> @@ -1715,6 +1715,9 @@ retry_duration:
>   
>                   av_log(s, AV_LOG_DEBUG, "Set channel data from MultiChannel info.\n");
>   
> +                if (avio_feof(s->pb))
> +                    return AVERROR_EOF;
> +
>                   goto next_track;
>               }
>           } else if (stream_type == FLV_STREAM_TYPE_VIDEO) {

I don't think just returning from here is correct.
The goto next_track right after it already checks for EOF.
I do not see how between here and the eof check there there'd be any way 
to infinite loop.

It returns FFERROR_REDO there, which is important to drain queued up 
packages.
The next time a call hits flv_read_packet will then immediately return 
AVERROR_EOF, since it's one of the first things the function checks.

So just throwing in a random AVERROR_EOF there seems incorrect to me, 
and is only hiding an actual issue elsewhere, if there is one.