mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/vividas: Check av_xiphlacing() return value before use
Fixes: out of array access Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
9bcb1cb6ed
commit
5937f05503
|
@ -392,8 +392,14 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *
|
||||||
p = st->codecpar->extradata;
|
p = st->codecpar->extradata;
|
||||||
p[0] = 2;
|
p[0] = 2;
|
||||||
|
|
||||||
for (j = 0; j < num_data - 1; j++)
|
for (j = 0; j < num_data - 1; j++) {
|
||||||
offset += av_xiphlacing(&p[offset], data_len[j]);
|
unsigned delta = av_xiphlacing(&p[offset], data_len[j]);
|
||||||
|
if (delta > data_len[j]) {
|
||||||
|
av_free(pb);
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
|
offset += delta;
|
||||||
|
}
|
||||||
|
|
||||||
for (j = 0; j < num_data; j++) {
|
for (j = 0; j < num_data; j++) {
|
||||||
int ret = avio_read(pb, &p[offset], data_len[j]);
|
int ret = avio_read(pb, &p[offset], data_len[j]);
|
||||||
|
|
Loading…
Reference in New Issue