From a56fdfc01f2b2c4f761c98e575c8015ab2f6beeb Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 31 Oct 2020 13:51:47 +0100 Subject: [PATCH] avformat/bintext: Check width in idf_read_header() Fixes: division by 0 Fixes: 26802/clusterfuzz-testcase-minimized-ffmpeg_dem_IDF_fuzzer-5180591554953216.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer (cherry picked from commit 442d53f409c8d84c7db120227caac00af54aa884) Signed-off-by: Michael Niedermayer --- libavformat/bintext.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavformat/bintext.c b/libavformat/bintext.c index 61b89f56d6..df0ddbc7c8 100644 --- a/libavformat/bintext.c +++ b/libavformat/bintext.c @@ -342,6 +342,8 @@ static int idf_read_header(AVFormatContext *s) bin->fsize = avio_size(pb) - 12 - 4096 - 48; ff_sauce_read(s, &bin->fsize, &got_width, 0); + if (st->codecpar->width < 8) + return AVERROR_INVALIDDATA; if (!bin->width) calculate_height(st->codecpar, bin->fsize); avio_seek(pb, 12, SEEK_SET);