From 56e2cd9c042e05255aa28487694c29aaec023263 Mon Sep 17 00:00:00 2001 From: Mark Harris Date: Mon, 15 Feb 2016 23:52:13 -0800 Subject: [PATCH] avformat/icodec: Fix crash probing fuzzed file Avoid invalid memory read/crash when frame offset >= 0xfffffff8. Base64-encoded example: AAABADAwMDAwMAAAMAAwMDAw/P///w== (The previous commit verifies that p->buf_size >= 22.) Signed-off-by: Michael Niedermayer --- libavformat/icodec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/icodec.c b/libavformat/icodec.c index b247cb2567..17acfb4b2f 100644 --- a/libavformat/icodec.c +++ b/libavformat/icodec.c @@ -63,7 +63,7 @@ static int probe(AVProbeData *p) offset = AV_RL32(p->buf + 18 + i * 16); if (offset < 22) return FFMIN(i, AVPROBE_SCORE_MAX / 4); - if (offset + 8 > p->buf_size) + if (offset > p->buf_size - 8) continue; if (p->buf[offset] != 40 && AV_RB64(p->buf + offset) != PNGSIG) return FFMIN(i, AVPROBE_SCORE_MAX / 4);