diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-09 22:04:16 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-11-14 23:30:37 +0100 |
| commit | 241f59eb8b4ab078a5d6642edd27b60019c03d8c (patch) | |
| tree | 4f90a46c8c060fae7a08da98b4d1488f232f1852 | |
| parent | 6aaca5234dd299568bd2acd03d27a22ab731b0b5 (diff) | |
| download | ffmpeg-241f59eb8b4ab078a5d6642edd27b60019c03d8c.tar.gz | |
avformat/aviobuf: Delay buffer downsizing until asserts are met
Fixes: Assertion failure
Fixes: 15151/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5757079496687616
Fixes: 15205/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5767573242642432
May fix: Ticket7094
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 0334632d5c02720f1829d59cd20c009584b5b163)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/aviobuf.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c index 636cb46161..c004e08bdf 100644 --- a/libavformat/aviobuf.c +++ b/libavformat/aviobuf.c @@ -557,7 +557,7 @@ static void fill_buffer(AVIOContext *s) } /* make buffer smaller in case it ended up large after probing */ - if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size) { + if (s->read_packet && s->orig_buffer_size && s->buffer_size > s->orig_buffer_size && len >= s->orig_buffer_size) { if (dst == s->buffer && s->buf_ptr != dst) { int ret = ffio_set_buf_size(s, s->orig_buffer_size); if (ret < 0) @@ -565,7 +565,6 @@ static void fill_buffer(AVIOContext *s) s->checksum_ptr = dst = s->buffer; } - av_assert0(len >= s->orig_buffer_size); len = s->orig_buffer_size; } |