RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/aaxdec: Check avio_seek() in header reading 

Fixes: Timeout
Fixes: 32450/clusterfuzz-testcase-minimized-ffmpeg_dem_AAX_fuzzer-4875522262827008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-04-12 21:21:08 +02:00
parent d866787dac
commit 602bbf71f6
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavformat/aaxdec.c
View File

@ -117,6 +117,7 @@ static int aax_read_header(AVFormatContext *s)
int64_t column_offset = 0; int64_t column_offset = 0;
int ret, extradata_size; int ret, extradata_size;
char *codec; char *codec;
int64_t ret64;
avio_skip(pb, 4); avio_skip(pb, 4);
a->table_size = avio_rb32(pb) + 8LL; a->table_size = avio_rb32(pb) + 8LL;
@ -218,7 +219,10 @@ static int aax_read_header(AVFormatContext *s)
} }
} }
avio_seek(pb, a->strings_offset, SEEK_SET); ret = ret64 = avio_seek(pb, a->strings_offset, SEEK_SET);
if (ret64 < 0)
goto fail;
ret = avio_read(pb, a->string_table, a->strings_size); ret = avio_read(pb, a->string_table, a->strings_size);
if (ret != a->strings_size) { if (ret != a->strings_size) {
if (ret < 0) if (ret < 0)
@ -249,7 +253,10 @@ static int aax_read_header(AVFormatContext *s)
goto fail; goto fail;
} }
avio_seek(pb, data_offset, SEEK_SET); ret = ret64 = avio_seek(pb, data_offset, SEEK_SET);
if (ret64 < 0)
goto fail;
if (type == COLUMN_TYPE_VLDATA) { if (type == COLUMN_TYPE_VLDATA) {
int64_t start, size; int64_t start, size;
@ -281,8 +288,8 @@ static int aax_read_header(AVFormatContext *s)
codec = a->string_table + a->name_offset; codec = a->string_table + a->name_offset;
if (!strcmp(codec, "AAX")) { if (!strcmp(codec, "AAX")) {
par->codec_id = AV_CODEC_ID_ADPCM_ADX; par->codec_id = AV_CODEC_ID_ADPCM_ADX;
avio_seek(pb, a->segments[0].start, SEEK_SET); ret64 = avio_seek(pb, a->segments[0].start, SEEK_SET);
if (avio_rb16(pb) != 0x8000) { if (ret64 < 0 || avio_rb16(pb) != 0x8000) {
ret = AVERROR_INVALIDDATA; ret = AVERROR_INVALIDDATA;
goto fail; goto fail;
} }