RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/vividas: Check av_xiphlacing() return value before use 

Fixes: out of array access
Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2019-08-21 23:05:21 +02:00
parent 9bcb1cb6ed
commit 5937f05503
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavformat/vividas.c
View File

@ -392,8 +392,14 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *
p = st->codecpar->extradata;
p[0] = 2;
for (j = 0; j < num_data - 1; j++)
offset += av_xiphlacing(&p[offset], data_len[j]);
for (j = 0; j < num_data - 1; j++) {
unsigned delta = av_xiphlacing(&p[offset], data_len[j]);
if (delta > data_len[j]) {
av_free(pb);
return AVERROR_INVALIDDATA;
}
offset += delta;
}
for (j = 0; j < num_data; j++) {
int ret = avio_read(pb, &p[offset], data_len[j]);