diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-04 16:18:35 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-24 17:53:39 +0200 |
| commit | 8e51f35f81c250892a97b6cf4b7c836ce7a3ffaf (patch) | |
| tree | d216d85e24b73f6560a5db39ed689ebb83c3e74c /libavformat/vividas.c | |
| parent | cede385018f5220910996a5158f5a793fed76d47 (diff) | |
avformat/vividas: Check n_sb_blocks against input space
Fixes: OOM
Fixes: 16726/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5719320750981120
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/vividas.c')
| -rw-r--r-- | libavformat/vividas.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/libavformat/vividas.c b/libavformat/vividas.c index cb4949b4a6..4cb371f556 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -422,7 +422,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * return 0; } -static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size) +static int track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *buf, unsigned size) { int64_t off; int64_t poff; @@ -432,16 +432,21 @@ static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *b pb = avio_alloc_context(buf, size, 0, NULL, NULL, NULL, NULL); if (!pb) - return; + return AVERROR(ENOMEM); ffio_read_varlen(pb); // track_index_len avio_r8(pb); // 'c' viv->n_sb_blocks = ffio_read_varlen(pb); + if (viv->n_sb_blocks * 2 > size) { + viv->n_sb_blocks = 0; + av_free(pb); + return AVERROR_INVALIDDATA; + } viv->sb_blocks = av_calloc(viv->n_sb_blocks, sizeof(VIV_SB_block)); if (!viv->sb_blocks) { viv->n_sb_blocks = 0; av_free(pb); - return; + return AVERROR(ENOMEM); } off = 0; @@ -464,6 +469,8 @@ static void track_index(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *b viv->sb_entries = av_calloc(maxnp, sizeof(VIV_SB_entry)); av_free(pb); + + return 0; } static void load_sb_block(AVFormatContext *s, VividasDemuxContext *viv, unsigned expected_size) @@ -589,8 +596,10 @@ static int viv_read_header(AVFormatContext *s) buf = read_vblock(pb, &v, key, &k2, v); if (!buf) return AVERROR(EIO); - track_index(viv, s, buf, v); + ret = track_index(viv, s, buf, v); av_free(buf); + if (ret < 0) + return ret; viv->sb_offset = avio_tell(pb); if (viv->n_sb_blocks > 0) { |