mirror of https://git.ffmpeg.org/ffmpeg.git
avformat/vividas: Check av_xiphlacing() return value before use
Fixes: out of array access Fixes: 16277/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5696629440512000 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
parent
9bcb1cb6ed
commit
5937f05503
libavformat
|
@ -392,8 +392,14 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t *
|
|||
p = st->codecpar->extradata;
|
||||
p[0] = 2;
|
||||
|
||||
for (j = 0; j < num_data - 1; j++)
|
||||
offset += av_xiphlacing(&p[offset], data_len[j]);
|
||||
for (j = 0; j < num_data - 1; j++) {
|
||||
unsigned delta = av_xiphlacing(&p[offset], data_len[j]);
|
||||
if (delta > data_len[j]) {
|
||||
av_free(pb);
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
offset += delta;
|
||||
}
|
||||
|
||||
for (j = 0; j < num_data; j++) {
|
||||
int ret = avio_read(pb, &p[offset], data_len[j]);
|
||||
|
|
Loading…
Reference in New Issue