RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/voc_packet: prevent remaining size from becoming negative in ff_voc_get_packet() 

Fixes: memleak
Fixes: 30909/clusterfuzz-testcase-minimized-ffmpeg_dem_AVS_fuzzer-4886284057313280

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-03-02 20:47:06 +01:00
parent c94875471e
commit 337984c133
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/voc_packet.c
View File

@ -51,14 +51,22 @@ ff_voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size)
return AVERROR_EOF;
voc->remaining_size = avio_rl24(pb);
if (!voc->remaining_size) {
int64_t filesize;
if (!(s->pb->seekable & AVIO_SEEKABLE_NORMAL))
return AVERROR(EIO);
voc->remaining_size = avio_size(pb) - avio_tell(pb);
filesize = avio_size(pb);
if (filesize - avio_tell(pb) > INT_MAX)
return AVERROR_INVALIDDATA;
voc->remaining_size = filesize - avio_tell(pb);
}
max_size -= 4;
switch (type) {
case VOC_TYPE_VOICE_DATA:
if (voc->remaining_size < 2) {
voc->remaining_size = 0;
return AVERROR_INVALIDDATA;
}
if (!par->sample_rate) {
par->sample_rate = 1000000 / (256 - avio_r8(pb));
if (sample_rate)
@ -87,6 +95,10 @@ ff_voc_get_packet(AVFormatContext *s, AVPacket *pkt, AVStream *st, int max_size)
break;
case VOC_TYPE_NEW_VOICE_DATA:
if (voc->remaining_size < 12) {
voc->remaining_size = 0;
return AVERROR_INVALIDDATA;
}
if (!par->sample_rate) {
par->sample_rate = avio_rl32(pb);
avpriv_set_pts_info(st, 64, 1, par->sample_rate);