RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/cook: Check subpacket index against max 

Fixes: off by 1 error
Fixes: index 5 out of bounds for type 'COOKSubpacket [5]'
Fixes: 25772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_COOK_fuzzer-5762459498184704.fuzz

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5a2a7604da)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-09-27 20:23:10 +02:00
parent 317b5bdcf2
commit b77c294c9a
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/cook.c
View File

@ -1084,6 +1084,10 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
ff_audiodsp_init(&q->adsp);
while (bytestream2_get_bytes_left(&gb)) {
if (s >= FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
return AVERROR_PATCHWELCOME;
}
/* 8 for mono, 16 for stereo, ? for multichannel
Swap to right endianness so we don't need to care later on. */
q->subpacket[s].cookversion = bytestream2_get_be32(&gb);
@ -1215,10 +1219,6 @@ static av_cold int cook_decode_init(AVCodecContext *avctx)
q->num_subpackets++;
s++;
if (s > FFMIN(MAX_SUBPACKETS, avctx->block_align)) {
avpriv_request_sample(avctx, "subpackets > %d", FFMIN(MAX_SUBPACKETS, avctx->block_align));
return AVERROR_PATCHWELCOME;
}
}
/* Try to catch some obviously faulty streams, otherwise it might be exploitable */