RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/ifv: Check that total frames do not overflow 

Fixes: Infinite loop
Fixes: 26392/clusterfuzz-testcase-minimized-ffmpeg_dem_GIF_fuzzer-5713658237419520
Fixes: 26435/clusterfuzz-testcase-minimized-ffmpeg_dem_SUBVIEWER_fuzzer-6548251853193216

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit b990148d1e)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-10-17 23:29:42 +02:00
parent 4d5d82314f
commit e583c69816
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/ifv.c
View File

@ -210,6 +210,7 @@ static int ifv_read_packet(AVFormatContext *s, AVPacket *pkt)
}
if (!ev) {
uint64_t vframes, aframes;
if (ifv->is_audio_present && !ea) {
/*read new video and audio indexes*/
@ -217,8 +218,12 @@ static int ifv_read_packet(AVFormatContext *s, AVPacket *pkt)
ifv->next_audio_index = ifv->total_aframes;
avio_skip(s->pb, 0x1c);
ifv->total_vframes += avio_rl32(s->pb);
ifv->total_aframes += avio_rl32(s->pb);
vframes = ifv->total_vframes + (uint64_t)avio_rl32(s->pb);
aframes = ifv->total_aframes + (uint64_t)avio_rl32(s->pb);
if (vframes > INT_MAX || aframes > INT_MAX)
return AVERROR_INVALIDDATA;
ifv->total_vframes = vframes;
ifv->total_aframes = aframes;
avio_skip(s->pb, 0xc);
if (avio_feof(s->pb))
@ -240,7 +245,10 @@ static int ifv_read_packet(AVFormatContext *s, AVPacket *pkt)
ifv->next_video_index = ifv->total_vframes;
avio_skip(s->pb, 0x1c);
ifv->total_vframes += avio_rl32(s->pb);
vframes = ifv->total_vframes + (uint64_t)avio_rl32(s->pb);
if (vframes > INT_MAX)
return AVERROR_INVALIDDATA;
ifv->total_vframes = vframes;
avio_skip(s->pb, 0x10);
if (avio_feof(s->pb))