diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-21 16:01:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-05-21 16:20:39 +0200 |
| commit | 0e003452c040b5b35f1aa33f4596540efa47f2a3 (patch) | |
| tree | ace26b2784e748f848e0220b329e3dc2c7c3bab0 | |
| parent | c06677aab1eb620780a450e2fb6c8f50bcdf2ccf (diff) | |
| download | ffmpeg-0e003452c040b5b35f1aa33f4596540efa47f2a3.tar.gz | |
avcodec/mpeg4videodec: Check for multiple VOL headers
Fixes multiple: runtime error: signed integer overflow: 2147115008 + 413696 cannot be represented in type 'int'
Fixes: 1723/clusterfuzz-testcase-minimized-5309409372667904
Fixes: 1727/clusterfuzz-testcase-minimized-5900685306494976
Fixes: 1737/clusterfuzz-testcase-minimized-5922321338466304
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit efeb47fd5d5cbf980e52a6d5e741c3c74b94b5e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index fc1c8297b9..77ef7465d7 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -2549,6 +2549,7 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb) MpegEncContext *s = &ctx->m; unsigned startcode, v; int ret; + int vol = 0; /* search next start code */ align_get_bits(gb); @@ -2637,6 +2638,11 @@ int ff_mpeg4_decode_picture_header(Mpeg4DecContext *ctx, GetBitContext *gb) } if (startcode >= 0x120 && startcode <= 0x12F) { + if (vol) { + av_log(s->avctx, AV_LOG_ERROR, "Multiple VOL headers"); + return AVERROR_INVALIDDATA; + } + vol++; if ((ret = decode_vol_header(ctx, gb)) < 0) return ret; } else if (startcode == USER_DATA_STARTCODE) { |