RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-22 07:20:45 +00:00
Code Issues Projects Releases Wiki Activity

avformat/mpc8: Check and propagate more errors

Browse Source 
Fixes: Timeout
Fixes: 48846/clusterfuzz-testcase-minimized-ffmpeg_dem_MPC8_fuzzer-5278532493770752

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-07-10 17:36:56 +02:00
parent ceff5d7b74
commit 8af798171b
1 changed files with 25 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
libavformat/mpc8.c
View File

@ -135,37 +135,40 @@ static void mpc8_get_chunk_header(AVIOContext *pb, int *tag, int64_t *size)
*size += pos;
}
static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
static int mpc8_parse_seektable(AVFormatContext *s, int64_t off)
{
MPCContext *c = s->priv_data;
int tag;
int64_t size, pos, ppos[2];
uint8_t *buf;
int i, t, seekd, ret;
int64_t ret64;
GetBitContext gb;
if (s->nb_streams == 0) {
av_log(s, AV_LOG_ERROR, "No stream added before parsing seek table\n");
return;
return AVERROR_INVALIDDATA;
}
avio_seek(s->pb, off, SEEK_SET);
ret64 = avio_seek(s->pb, off, SEEK_SET);
if (ret64 < 0)
return AVERROR_INVALIDDATA;
mpc8_get_chunk_header(s->pb, &tag, &size);
if(tag != TAG_SEEKTABLE){
if(tag != TAG_SEEKTABLE || avio_feof(s->pb)){
av_log(s, AV_LOG_ERROR, "No seek table at given position\n");
return;
return AVERROR_INVALIDDATA;
}
if (size > INT_MAX/10 || size<=0) {
av_log(s, AV_LOG_ERROR, "Bad seek table size\n");
return;
return AVERROR_INVALIDDATA;
}
if(!(buf = av_malloc(size + AV_INPUT_BUFFER_PADDING_SIZE)))
return;
return AVERROR(ENOMEM);
ret = avio_read(s->pb, buf, size);
if (ret != size) {
av_log(s, AV_LOG_ERROR, "seek table truncated\n");
av_free(buf);
return;
return AVERROR_INVALIDDATA;
}
memset(buf+size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
@ -174,14 +177,14 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
if(size > UINT_MAX/4 || size > c->samples/1152){
av_log(s, AV_LOG_ERROR, "Seek table is too big\n");
av_free(buf);
return;
return AVERROR_INVALIDDATA;
}
seekd = get_bits(&gb, 4);
for(i = 0; i < 2; i++){
pos = gb_get_v(&gb);
if (av_sat_add64(pos, c->header_pos) != pos + (uint64_t)c->header_pos) {
av_free(buf);
return;
return AVERROR_INVALIDDATA;
}
pos += c->header_pos;
@ -191,7 +194,7 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
for(; i < size; i++){
if (get_bits_left(&gb) < 13) {
av_free(buf);
return;
return AVERROR_INVALIDDATA;
}
t = get_unary(&gb, 1, 33) << 12;
t += get_bits(&gb, 12);
@ -203,26 +206,31 @@ static void mpc8_parse_seektable(AVFormatContext *s, int64_t off)
ppos[0] = pos;
}
av_free(buf);
return 0;
}
static void mpc8_handle_chunk(AVFormatContext *s, int tag, int64_t chunk_pos, int64_t size)
static int mpc8_handle_chunk(AVFormatContext *s, int tag, int64_t chunk_pos, int64_t size)
{
AVIOContext *pb = s->pb;
int64_t pos, off;
int ret;
switch(tag){
case TAG_SEEKTBLOFF:
pos = avio_tell(pb);
off = ffio_read_varlen(pb);
if (pos > INT64_MAX - size || off < 0 || off > INT64_MAX - chunk_pos)
return;
return AVERROR_INVALIDDATA;
pos += size;
mpc8_parse_seektable(s, chunk_pos + off);
ret = mpc8_parse_seektable(s, chunk_pos + off);
if (ret < 0)
return AVERROR_INVALIDDATA;
avio_seek(pb, pos, SEEK_SET);
break;
default:
avio_skip(pb, size);
}
return 0;
}
static int mpc8_read_header(AVFormatContext *s)
@ -249,7 +257,9 @@ static int mpc8_read_header(AVFormatContext *s)
}
if(tag == TAG_STREAMHDR)
break;
mpc8_handle_chunk(s, tag, pos, size);
ret = mpc8_handle_chunk(s, tag, pos, size);
if (ret < 0)
return ret;
}
if(tag != TAG_STREAMHDR){
av_log(s, AV_LOG_ERROR, "Stream header not found\n");