mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/matroskadec: Fix infinite loop with bz decompression
The same check is added to zlib too, it seems not needed there though
Fixes: Infinite loop
Fixes: 43932/clusterfuzz-testcase-minimized-ffmpeg_dem_MATROSKA_fuzzer-6175167573786624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 9c3d2cbb51
)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
423a3b685f
commit
893c4f1151
|
@ -1399,7 +1399,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
|
||||||
case MATROSKA_TRACK_ENCODING_COMP_ZLIB:
|
case MATROSKA_TRACK_ENCODING_COMP_ZLIB:
|
||||||
{
|
{
|
||||||
z_stream zstream = { 0 };
|
z_stream zstream = { 0 };
|
||||||
if (inflateInit(&zstream) != Z_OK)
|
if (!pkt_size || inflateInit(&zstream) != Z_OK)
|
||||||
return -1;
|
return -1;
|
||||||
zstream.next_in = data;
|
zstream.next_in = data;
|
||||||
zstream.avail_in = isize;
|
zstream.avail_in = isize;
|
||||||
|
@ -1432,7 +1432,7 @@ static int matroska_decode_buffer(uint8_t **buf, int *buf_size,
|
||||||
case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
|
case MATROSKA_TRACK_ENCODING_COMP_BZLIB:
|
||||||
{
|
{
|
||||||
bz_stream bzstream = { 0 };
|
bz_stream bzstream = { 0 };
|
||||||
if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
|
if (!pkt_size || BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK)
|
||||||
return -1;
|
return -1;
|
||||||
bzstream.next_in = data;
|
bzstream.next_in = data;
|
||||||
bzstream.avail_in = isize;
|
bzstream.avail_in = isize;
|
||||||
|
|
Loading…
Reference in New Issue